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Abstract 

We give a novel algorithm for enumerating lattice points in any convex body, and give applications 
to several classic lattice problems, including the Shortest and Closest Vector Problems (SVP and CVP, 
respectively) and Integer Programming (IP). Our enumeration technique relies on a classical concept 
from asymptotic convex geometry known as the M-ellipsoid, and uses as a crucial subroutine the recent 
algorithm of Micciancio and Voulgaris (STOC 2010) for lattice problems in the £2 norm. As a main 
technical contribution, which may be of independent interest, we build on the techniques of Klartag 
(Geometric and Functional Analysis, 2006) to give an expected 2'^^"''-time algorithm for computing an 
M-ellipsoid for any n-dimensional convex body. 

As applications, we give deterministic 2'^("'-time and -space algorithms for solving exact SVP, and 
exact CVP when the target point is sufficiently close to the lattice, on n-dimensional lattices in any 
(semi-)norm given an M-ellipsoid of the unit ball. In many norms of interest, including all £p norms, 
an M-ellipsoid is computable in deterministic poly(n) time, in which case these algorithms are fully 
deterministic. Here our approach may be seen as a derandomization of the "AKS sieve" for exact SVP 
and CVP (Ajtai, Kumar, and Sivakumar; STOC 2001 and CCC 2002). 

As a further application of our SVP algorithm, we derive an expected 0{f* (rt))"-time algorithm for 
Integer Programming, where /* (n) denotes the optimal bound in the so-called "flatness theorem," which 
satisfies f*{n) ~ 0(n^/'^ polylog(ri)) and is conjectured to be f*{n) — Q{n). Our runtime improves 
upon the previous best of 0(n^)" by Hildebrand and Koppe (2010). 

Keywords. Shortest/Closest Vector Problem, Integer Programming, lattice point enumeration, M-elUpsoid. 
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1 Introduction 



The Shortest and Closest Vector Problems (SVP and CVP, respectively) on lattices are central algorith- 
mic problems in the geometry of numbers, with applications to Integer Programming IILen83L factoring 
polynomials over the rationals [iLLL821 . cryptanalysis (e.g., IIQdl90[ IJS981 INSOTI ). and much more. (An 
n-dimensional lattice L is a discrete additive subgroup of M", and is generated as the set of integer linear 
combinations of some basis vectors bi, . . . ,bk € M", for some k < n.) The SVP is simply: given a lattice 
L represented by a basis, find a nonzero v ^ L such that \\v\\ is minimized, where ||-|| denotes a particular 
norm on R". The CVP is an inhomogeneous analogue of SVP: given a lattice L and a point t G W^, find 
some u G L that minimizes ||u — In these problems, one often uses the Euclidean {£2) norm, but many 
applications require other norms like £p or, most generally, the semi-norm defined by a convex body K B 
as ll^lli^: = inf{r > : x G rK}. Indeed, general (semi-)norms arise quite often in the study of lattices; 
for example, the "flatness theorem" in Integer Programming — which states that every lattice-free convex 
body has lattice width bounded by a function of the dimension alone — is a statement about SVP in general 
norms. 

Much is known about the computational complexity of SVP and CVP, in both their exact and approx- 
imation versions. On the negative side, SVP is NP-hard (in £2, under randomized reductions) to solve 
exactly, or even to approximate to within any constant factor | Ajt98[ ICN98I IMic98[ IKho03l . Many more 
hardness results are known for other £p norms and under stronger complexity assumptions than P 7^ NP 
(see, e.g., llvEB8 1 1 iDmOOl IRR061 IHROTI '). CVP is NP-hard to approximate to within n'=/'°si°e" factors for 
some constant c > IIABSS931 IDKRS981 IDinOOl . where n is the dimension of the lattice. Therefore, we 
do not expect to solve (or even closely approximate) these problems efficiently in high dimensions. Still, 
algorithms providing weak approximations or having super-polynomial running times are the foundations 
for the many applications mentioned above. 

The celebrated LLL algorithm IILLL82II and variants liSchSTl give 2"/P°iy'°g('^) approximations to SVP 
and CVP in £2, in poly(n) time. For exact SVP and CVP in the £2 norm, Kannan's algorithm llKan87l gives 
a solution in deterministic 2'^("^°§") time and poly(n) space. This performance remained essentially un- 
challenged until the breakthrough randomized "sieve" algorithm of Ajtai, Kumar, and Sivakumar IIAKSOIL 
which provides a 2'^('^)-time and -space solution for exact SVP; moreover, the algorithm generalizes straight- 
forwardly to £p and other norms IIBN07[ lAJ08l. For CVP, in a sequence of works tAKS02[ IBNOTI lAJ0 8^ it 
was shown that a modified version of the AKS sieve can approximate CVP in any £p norm to within a (1 + e) 
factor in time and space (l/e)*^^") for any e > 0. Furthermore, these algorithms can solve CVP exactly in 
2<-'(") time as long as the target point is "very close" to the lattice. It is worth noting that the AKS sieve is a 
Monte Carlo algorithm: while the output solution is correct with high probability, it is not guaranteed. 

In a more recent breakthrough, Micciancio and Voulgaris [MVIO] gave a deterministic 2'^(")-time (and 
space) algorithm for exact SVP and CVP in the £2 norm, among many other lattice problems in NP. Inter- 
estingly, their algorithm works very differently from the AKS sieve, by computing an explicit description 
of the Voronoi cell of the lattice. (The Voronoi cell is the set of all points in that are closer to the origin 
than to any other lattice point.) In contrast to the AKS sieve, however, the algorithm of [MVIO] appears to 
be quite specialized to £2 (or any norm defined by an ellipsoid, simply by applying a linear transformation). 
This is in part because in £2 the Voronoi cell is convex and has 2*^(") facets, but in general norms this is not 
the case. A main problem left open in HMVlOl was to find deterministic 2*^ '^"^ -time algorithms for lattice 
problems in £p and other norms. 
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1.1 Results and Techniques 



Our main contribution is a novel algorithm for enumerating lattice points in any convex body. It uses as a 
crucial subroutine the Micciancio-Voulgaris (MV) algorithm MMVIOI for the £2 norm that enumerates lattice 
points in an ellipsoid, and relies on a classical concept from asymptotic convex geometry known as the M- 
ellipsoid. This connection between lattice algorithms and convex geometry appears to be a fertile direction 
for further research. 

For a lattice L and convex body K in M", let G{K, L) be the largest number of lattice points contained 
in any translate of K, i.e., 

= max|(if + x)nL|. (1.1) 
Our starting point is the following guarantee on the enumeration of n lQ 

Theorem 1.1 (Enumeration in convex bodies, informal). Given any convex body K C along with an 
M-ellipsoid E of K, and any n-dimensional lattice L C M", the set KCiL can be computed in deterministic 
time G{K, L) ■ 2^("). 

As we describe later, an M-ellipsoid of a convex body K C M" is an ellipsoid with roughly the 
same 'size' and 'shape' as K. We will show that it can generated in randomized poly(n) time with high 
probability, and verified in deterministic 2*^*^"^ time, and hence can always be computed in expected 2'^(") 
time. Moreover, in many specific cases of interest, such as the unit ball of any ip norm, an M-ellipsoid is 
deterministically computable in poly(n) time. 

Our enumeration algorithm is at the core of the following applications. We begin with the Shortest 
Vector Problem in any "well-centered" semi-normjl 

Theorem 1.2 (SVP in any (semi-)norm, informal). There is a deterministic 2^^^^-time (and -space) algo- 
rithm that, given any well-centered n-dimensional convex body K and an M-ellipsoid E of K, solves SVP 
exactly on any n-dimensional lattice L in the semi-norm \\-\\k defined by K. 

Besides being a novel algorithm, the improvement over previous approaches is in the generalization to 
(semi-)norms defined by arbitrary convex bodies, the use of much less randomness (if any), and in having a 
Las Vegas algorithm whose output is guaranteed to be correct. 

We get a similar algorithm for the Closest Vector Problem, but its complexity grows with the distance 
from the target point to the lattice. 

Theorem 1.3 (CVP in any (semi-)norm, informal). There is a deterministic algorithm that, given any 
well-centered n-dimensional convex body K and an M-ellipsoid E of K, solves CVP exactly on any n- 
dimensional lattice L in the semi-norm \\-\\k 

defined by K, in (1 + 2a)" • 2'^(") time and space, provided 
that the distance from the query point x to L is at most a times the length of the shortest nonzero vector of 
L (under \\-\\k)- 

A main motivation of our work is to develop more powerful tools for solving Integer Programming. We 
note that solving IP reduces to solving CVP in any well-centered semi-norm: to decide li K f\ L ^ $, first 
approximate the centroid b of K, then solve CVP with respect to the well-centered body K — bon lattice L 

'For simplicity, througliout tliis introduction tlie claimed running times will omit polynomial factors in the lengths of the 
algorithms' inputs, which are represented in the usual way. 

^"Well-centered" means that wo\{K n ~K) > 4~" vol{K); this clearly holds for centrally symmetric K, which corresponds 
to a standard norm. It also holds for any convex body K with centroid at or very near the origin. 
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and target point b. Then K n L ^ ^ if and only if there exists y ^ L such that \\y — h\\K-b < 1- However, 
unless we have a bound on the ratio a from the above theorem, we may not get a satisfactory guarantee on 
the running time of our CVP algorithm in this setting. 

For the general case, we can still get an unqualified improvement in the state of the art for IP using our 
SVP algorithm for general norms. 

Theorem 1.4 (Integer Programming, informal). There exists a randomized algorithm that, given a convex 
body K C R" and an n-dimensional lattice L C M", either decides that K D L = ^ or returns a point 
y £ K f] L in expected 0{f*{n))^ time, where f*{n) is the optimal bound for the "flatness theorem." 

The flatness theorem, a fundamental result in the geometry of numbers, says that every lattice-free 
convex body has lattice width bounded by a function of the dimension alone (see Equation (14.81) for a precise 
statement). As first noticed by Lenstra IILen83il . it suggests a recursive algorithm for IP that uses a subroutine 
for finding good flatness directions. Finding an optimal flatness direction directly reduces to solving an SVP 
in a general norm, which was solved only approximately in previous refinements of Lenstra's algorithm. 
The above is therefore an essentially "optimal" Lenstra-type algorithm with respect to the classical analysis. 

Using the current best known bounds on f*{n) ^B LPS 991 IRudOOI . our IP algorithm has a main com- 
plexity term of order 0{n'^/^ \og'^ n)". This improves on the previous fastest algorithm of Hildebrand and 
Koppe IIHKIOII which gives a leading complexity term of 0(n^)"; the previous best before that is due 
to Kannan rK anSTl and achieves a leading complexity term of 0(n^-^)". It is conjectured that /*(n) = 
e(n) l,BLPS99 ll. and this would give a bound of 0{nY for IP. 

In the rest of this introduction we give an overview of our enumeration technique and its application to 
SVP, CVP, and IP. 

Enumeration via M-ellipsoid coverings. We now explain the main technique underlying Theorem 11.11 
(enumeration of lattice points in a convex body K). The key concept we use is a classical notion from 
asymptotic convex geometry, known as the M-ellipsoid. An M-ellipsoid E for a convex body K has the 
property that 2'^^"^ copies (translates) of E can be used to cover K, and 2'^(") copies of K suffice to 
cover E. The latter condition immediately implies that 

G{E, L) < 2^(") • G{K, L). (1.2) 

Using the former condition, enumerating Kr\L therefore reduces to enumerating {E+t)r\L for at most 2*^^") 
values of t (and keeping only those lattice points in K), which can be done in deterministic 2*^*^"^ • G{E, L) 
time by (an extension of) the MV algorithm MMVIOII . 

The existence of an M-ellipsoid for any convex body K was established by Milman fMil86J IMPOOI . 
and there are now multiple proofs. Under the famous slicing conjecture l,Bou86 l. an appropriate scaling of 
iT's inertial ellipsoid (defined by the covariance matrix of a uniform random point from K) is in fact an 
M-ellipsoid. When K is an Ip ball, an M-ellipsoid is simply the scaled ^2 ball ■n}/'^~^/P ■ i?^. 

For general convex bodies K, we give an algorithm for computing an M-ellipsoid of K, along with 
a covering by copies of the ellipsoid. Under the slicing conjecture, the former task is straightforward: 
simply estimate the covariance matrix of K using an algorithm for sampling uniformly from a convex 
body (e.g., IIDFK89I ). To avoid assuming the slicing conjecture, we use an alternative proof of M-ellipsoid 
existence due to Klartag IIKla06l . The resulting guarantees can be stated as follows. 
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Theorem 1.5 (M-ellipsoid generator, informal). There is a polynomial-time randomized algorithm that with 
high probability computes an M-ellipsoid E of a given n-dimensional convex body 



Theorem 1.6 (M-ellipsoid covering algorithm, informal). Given an ellipsoid E and convex body K, there 
is a deterministic 2^^'^^ -time algorithm which certifies that E is an M-ellipsoid of K, and if so returns a 
covering of K by 2^^"'^ copies of E^ 

Combining these two theorems, we get an expected 2'^(")-time algorithm that is guaranteed to output an 
M-ellipsoid and its implied covering for any given convex body K. It is an interesting open problem to find 
a deterministic 2'^(")-time algorithm. We note that deterministic algorithms must have complexity 2^("), 
since an M-ellipsoid gives a 2*^^") approximation to the volume of K, and such an approximation is known 
to require 2^(") time when K is specified by an oracle IIFB86II . 

Shortest and Closest Vector Problems. Here we outline our deterministic 2'^(")-time algorithm for SVP 
in any norm defined by a symmetric convex body K, given an M-ellipsoid of K. (Well-centered semi-norms 
are dealt with similarly.) For instance, as noted above the scaled ^2 ball Ep = n^l'^~^IP ■ B2 is an M-ellipsoid 
for any Ip ball K = Bp. Moreover, a good covering of Bp by Ep is straightforward to obtain: for p > 2, 
just one copy of Ep works (since Bp C Ep), while for 1 < p < 2, we can cover Bp by a tiling of Ep's 
axis-aligned inscribed cuboid. 

Let L be an n-dimensional lattice, and let Ai = Xi{K,L) be the length of its shortest vector under 
\\-\\k- We can assume by rescaling that 1/2 < Ai < 1, so K contains an SVP solution. Our algorithm 
simply enumerates all nonzero points in KnL (using Theorem ll.il ). and outputs one of the shortest. For the 
running time, it suffices to show that G{K, L) < 2*^("\ which follows by a simple packing argument: for 
any x G M", copies of \K centered at each point in {K + x) r\ L are pairwise disjoint (because Ai > 1/2) 
and contained in + x, so \{K + x)r\L\< vol(f / ^o\{\K) = 5". 

For CVP with target point x, the strategy is exactly the same as above, but we use a scaling dK so that 
{dK — x) D L ^ $ and {^K — x) D L = $ (i.e., d is a 2-approximation of the distance from x to L). In this 
case, the packing argument gives a bound of G{dK, L) < (1 + 2d/\i)^. 

In retrospect, the above algorithms can be seen as a derandomization (and generalization to semi-norms) 
of the AKS sieve-based algorithms for exact SVP in general norms, and exact CVP in £p norms HAKSOU 
IAKS021 IBN07I lAJOSl . with matching running times (up to 2'^^") factors). Specifically, our algorithms de- 
terministically enumerate all lattice points in a convex region, rather than repeatedly sampling until all such 
points are found with high probability. However, we do not know whether our techniques can derandomize 
the (1 + e) -approximate CVP algorithms of IIAKS021 IBN07II in asymptotically the same running time. 

Integer Programming. Our algorithm for Integer Programming (finding a point in K n L, if it exists) 
follows the basic outline of all algorithms since that of Lenstra IILen83ll . It begins with two pre-processing 
steps: one to refine the basis of the lattice, and the other to find an ellipsoidal approximation of K. If the 
ellipsoid volume is sufficiently small compared to the lattice determinant, then we can directly reduce to a 
lower-dimensional problem. The main step of the algorithm (and Lenstra's key insight, refined dramatically 
by Kannan IIKan87ll ) is to find a direction along which the lattice width of K is small. Given such a direc- 
tion, we recurse on the lattice hyperplanes orthogonal to this direction that intersect K, thus reducing the 
dimension of the problem by one. 

'We thank Bo'az Klartag for suggesting to us that the techniques in |Kla06l could be used to algorithmically construct an 
M-ellipsoid. 

''Gideon Schechtman suggested a construction of the covering using parallelepiped tilings. 
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In previous work, a small lattice-width direction was found by replacing K by an ellipsoid E contain- 
ing K, then solving SVP in the norm defined by the dual ellipsoid E* on the dual lattice L* . Here we instead 
use our SVP algorithm for general norms, solving it directly for the norm induced by {K — K)* on L* . This 
refinement allows us to use the best-known bounds on /* (n) (from the flatness theorem) for the number of 
hyperplanes on which we have to recurse. 

1.2 Organization 

The remainder of the paper is organized as follows. In Section |2] we recall basic concepts from convex 
geometry that are needed to understand our M-ellipsoid algorithms. In Section [3] we give the M-ellipsoid 
construction (formalizing Theorems 11.51 and 11.61 ). In Section |4] we formalize our enumeration technique 
(Theorem 11.11 ) and apply it to give algorithms for SVP, CVP and IP. Appendix |A] contains the proofs of 
correctness for our M-ellipsoid construction, and Appendix IbI contains supporting technical material. 

2 Convex Geometry Background 

Convex bodies. K C M" is a convex body if K is convex, compact and full-dimensional. We say that a 
body is centrally symmetric, or O-symmetric, ii K = —K. 

For sets A,Bg M" we define the Minkowski sum of A and B as 



For a vector t G M", we define t -\- A = {t} + A for notational convenience. 

Let K C be a convex body such that € K. We define the gauge function, or Minkowski functional, 
of K as 



From classical convex analysis, we have that the functional H-Hi^- is a semi-norm, i.e., it satisfies the 
triangle inequality and = for t > 0, x G M". If K is centrally symmetric, then ||.||x is a 

norm in the usual sense. 

The polar (or dual) body K* is defined as 



A-\- B = {x + y: X £ A,y £ B}. 



(2.1) 



x\\k = inf{r > : x € rK}, x e M". 



(2.2) 



= {x G M" : Vy G K, {x, y) < 1}. 



(2.3) 



A basic result in convex geometry is that K* is convex and that (K*)* = K. 
Define the Ip norm on M" as 




(2.4) 



For convenience we write ||x|| for ||x||2. Let B"^ = {x G M" : ||x||p < 1} denote the ball in M". Note 
from our definitions that ||x||b" = ||x||p for x G M". 

For a positive definite matrix A G M"^", we define the inner product with respect to A as 



{x,y)j^ = x^Ay x,yGM". 



(2.5) 
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We define the norm generated by A as = \/ {x, x)^ = V x^Ax. For a vector a E M", we define the 

elUpsoid E{A, a) = {x G M" : ||x - a\\A < 1}- For convenience we shall let E{A) = E{A, 0). Note that 
with our notation, ||a;m = The volume of an ellipsoid E{A, a) is given by the formula 

Yol{E{A, a)) = vol{E{A)) = voliB^) • Vdet(^-i). (2.6) 

Lastly, an elementary computation gives the useful fact that E{A)* = E{A^^). 

We define the centroid (or barycenter) h{K) € M" and covariance matrix cov(iir) G M"^" as 

= I ^tIt = / - - b{K)r^- 

Jk vo\{K) Jk \o\{K) 

We note that cov(i^) is always positive definite and symmetric. The inertial ellipsoid of K is defined as 
Ek = E{coy{K)~^). The isotropic constant of K is 

Lk = det(cov(if))2^/vol(K)l (2.7) 

A major open conjecture in convex geometry is the following: 

Conjecture 2.1 (Slicing Conjecture IIBou86ll ). There exists an absolute constant C > 0, such that Lk < C 
for all n > and any convex body K C W^. 

The original bound computed by Bourgain |IBou861 was Lk = 0(n^/^ log n). This has since been 
improved by Klartag [Kla06] to L^ = 0(n^/^). In addition, the conjecture has been verified for many 
classes of bodies including the Ip norm balls. 

The above concepts (centroid, covariance, isotropic constant, inertial ellipsoid) all generalize easily to 
logconcave functions in lieu of convex bodies; see Appendix |B] for details. 

Computational model. All our algorithms will work with convex bodies and norms presented by oracles 
in the standard way. The complexity of our algorithms will be measured by the number of arithmetic 
operations as well as the number of calls to the oracle. See Appendix IB] for a more detailed description of 
the kinds of oracles we use. 

3 Computing M-EUipsoids and Coverings 

An M-ellipsoid of a convex body K is an ellipsoid E with the property that at most 2'^'^"^ translated copies 
of E are sufficient to cover all of K, and at most 2'^^") copies of K are sufficient to cover E. More precisely, 
for any two subsets A,B G M", define the covering number 

N{A,B) = min{|A| : A C M", yl C B + A}. (3.1) 

Hence A^(^, B) is the minimum number of translates of B needed to cover A. The following theorem was 
first proved for symmetric bodies by Milman IIMil86 1 and extended by Milman and Pajor liMPOOJ to the 
general case. 

Theorem 3.1 ( UMPOOII ). There exists an absolute constant C > 0, such that for all n > 1 and any convex 
body K C R", there exists an ellipsoid E satisfying 

N{K, E) ■ N{E, K) < C". (3.2) 
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Definition 3.2 (M-ellipsoid). Let K C M" be a convex body. If E is an ellipsoid satisfying Equation (13.21) 
(for some particular fixed C) with respect to K, then we say that E is an M-ellipsoid of K. 

There are many equivalent ways of understanding the M-ellipsoid; here we list a few (proofs of many of 
these equivalences can be found in IIMPOOII ). 

Tlieorem 3.3. Let K C M" be a convex body with h{K) = (centroid at the origin), and let E C be an 
origin-centered ellipsoid. Then the following conditions are equivalent, where the absolute constant C may 
vary from line to line: 

1. N{K,E) ■ N{E,K) < C". 

2. vol{K + E)<C'' ■ min{vol(E), vol(K)}. 

3. supigjjn Yo\{K n (t + E)) > • max{vol(^), vol(i^)}. 

4. E* is an M-ellipsoid of K*. 

From the above we see that the M-ellipsoid is very robust object, and in particular is stable under polarity 
(assuming K is well-centered). We will use this fact (or a slight variant of it) in what follows, to help us 
certify a candidate M-ellipsoid. 

As mentioned in the introduction, an M-ellipsoid for an £p ball is trivial to compute. Using condition [3] 
of Theorem 13.31 above and standard volume estimates for ip balls, i.e., that vol(i?p)^/" = Q{n^^^'P), we 
have the following: 

Lemma 3.4. Let denote the n-dimensional ip ball. Then 

11 

• For 1 < p < 2, p ■ B2 Q Bp (the largest inscribed ball in Bp) is an M-ellipsoid for Bp. 

i_i 

• For p > 2, n2 p ■ B2 5 Bp (the smallest containing ball of Bp) is an M-ellipsoid for Bp. 

For general convex bodies, the proofs of existence of an M-elUpsoid in IIMil86ll and liMPOOl are non- 
constructive. It is worth noting, however, that under the slicing conjecture (also known as the hyperplane 
conjecture), a ^/n scaling of K's inertial ellipsoid is an M-ellipsoid — indeed, this is an equivalent form 
of the slicing conjecture. For many norms, including £p, absolutely symmetric norms (where the norm is 
preserved under coordinate sign flips), and other classes, the slicing conjecture has been proved. Therefore, 
for such norms, an M-ellipsoid computation is straightforward: using random walk techniques, estimate the 
covariance matrix cov(K) of K, the unit ball of the norm, and return a ^/n scaling of K's inertial ellipsoid. 

In the rest of this section, we describe how to generate an M-ellipsoid in general, without directly relying 
on the slicing conjecture, with good probability in probabilistic polynomial time. Moreover, we show how 
to certify that an ellipsoid is an M-ellipsoid in deterministic 2'^^") time. A by-product of the certification is 
a covering of the target body by at most 2*^(") translates of the candidate M-ellipsoid. Such a covering will 
be used by all the lattice algorithms in this paper. 

Proofs for all the theorems in this section can be found in Appendix lAl 

3.1 The Main Algorithm 

The main result of this section is Algorithm [T](M-Ellipsoid), whose correctness is proved in Theorem 13.51 
The algorithm uses two main subroutines. The first, M-Gen, described in Section |3^ below, produces a 
candidate ellipsoid that is an M-ellipsoid with good probability. The second, Build-Cover, described in 
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Algorithm 1 M-Ellipsoid: Generate a guaranteed M-ellipsoid and its implied covering. 
Input: A weak membership oracle Ok for a (0, r, i?)-centered convex body K. 
Output: An M-ellipsoid E of K, and a covering of K by 2'^(") copies of E. 
1: Approximate the centroid of K using algorithm Estimate-Centroid (Lemma [B.9I ). If Estimate-Centroid 

fails, restart; otherwise, let h denote returned estimate for b{K). 
2: Generate a candidate M-ellipsoid E of K using Algorithm |2](M-Gen) on — 6. 
3: Check if N{K, E) > (13e)" using Algorithmic] (Build-Cover). If yes, restart; otherwise, let T denote 

the returned covering of K by E. 
4: Check if N{{K - K)*,E*) > (25e • 13)"- using Algorithm [3] (Build-Cover). If yes, restart; otherwise, 
return {E,T). 



Section [331 is used to check that both N{K, E), N{{K - K)* , E*) = 2<^(") by constructing explicit 
coverings (if possible). Because N{E,K) ^ N{{K - K)*,E*) (up to 2®(") factors) by the duality of 
entropy (Theorem IA.2I ). such coverings suffice to prove that E is an M-ellipsoid for K. 

Theorem 3.5 (Correctness of M-Ellipsoid). For large enough n, Algorithm [7] (M-Ellipsoid) outputs an 
ellipsoid E satisfying 

N{K, E) < (ys^ ■ 13e) " and N{E, K) < (^\/8^ • 25e • 13 • 289^ " (3.3) 

along with asetT C Q", |T| < (VSvre • 13e)" such that K C T + E, in expected time (\/87re • 25e • 13)" • 
poly(n,log(|)). 

3.2 Generating a Candidate M-Ellipsoid 

Our algorithm for generating a candidate M-ellipsoid is based on a constructive proof of Theorem 13. II by 
Klartag fKlaO&l, who suggested to us the idea of using these techniques to build an M-ellipsoid algorithmi- 
cally. The main theorem of [iKla06J . reproduced below, does not explicitly refer to M-ellipsoids; instead, 
it shows that for every convex body K, there is another convex body K' that sandwiches K between two 
small scalings and satisfies the slicing conjecture. 

Theorem 3.6 ( IIKla06ll ). Let K C.W- be a convex body. Then for every real e £ (0, 1), there exists a convex 
body K' C M" such that 

b c 
d(K, K') = inf{- : 3 t G M" s.t. aK' C K - t C bK'} < 1 + e and Lk' < (3.4) 

where c> Q is an absolute constant and Lx' is the isotropic constant of K'. 

From the closeness of K and K' it follows that an M-ellipsoid for K' is an M-ellipsoid for K, and from 
the bound on L^' the inertial ellipsoid of K' is an M-ellipsoid for K' . 

Here we will not need to construct K' itself, but only an ellipsoid very close to its inertial ellipsoid (which 
as just mentioned is an M-ellipsoid for K). The body K' is derived from a certain family of reweighted 
densities over K. These densities are given by exponential reweightings of the uniform density along some 
vector s G W\ i.e., /s(x) = e^^'^'^ fov x £ K (and otherwise). For s chosen uniformly from n ■ 
conv{K — b{K),b{K) — K}*, the reweighting fg has two important properties: (i) it is not too highly 
biased away from uniform over K, and (ii) it has bounded isotropic constant (independent of n) with very 
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high probability. Let E be the inertial elhpsoid of fg (or any reasonably good approximation to it), which 
can be found by sampling from fg. The first property of fg allows us to prove that E can be covered by 
20(n) copies of K, while the second property lets us cover K by 2'^(") copies of E (see Lemma |AT3l ). 

To make everything work algorithmically, we need robust versions of Klartag's main lemmas, since we 
will only be able to compute an approximate centroid of K, sample s from a distribution close to uniform, 
and estimate the covariance matrix of fg. 

Algorithm |2] makes the above description more formal. Note that given an oracle for a convex body, 
an oracle for the polar body can be constructed in polynomial time I GLS88.I . Sampling, both from the 
uniform and exponentially reweighted distributions, can be done in polynomial time using the random walk 
algorithm of IILV06bl rLV06al . Theorem |A3] together with Lemma lA!4l implies that the algorithm's output 
is indeed an M-ellipsoid with good probability. 

Algorithm 2 M-Gen: Randomized generation of a candidate M-ellipsoid. 

Input: A weak membership oracle Ok for a (0, r, i?)-centered convex body K with b{K) G ^Ek. 
Output: With probability 1 — o(l), an M-ellipsoid of K. 

1: Estimate the centroid b = b{K) using uniform samples from K. 

2: Construct a membership oracle for n {con\{K — b,b — K})*. 

3: Sample a random vector s from n (conv{K — b,b — K})* . 

4: Estimate the covariance matrix A of the density proportional to e^^'^\ restricted to K. 
5: Output the ellipsoid ^(^1^^) = {x : x^A^^x < 1}. 



Theorem 3.7 (Correctness of M-Gen). For large enough n, Algorithm\2\(M-Gen) outputs an ellipsoid E 
satisfying 

N{E,K) <{2hey' and iV(K, < (13e)" (3.5) 
with probability at least 1 — ^in time poly(n, log(-p)). 

3.3 Building a Covering 

The next theorem yields an algorithm to approximately decide (up to single exponential factors) whether a 
given convex body K can be covered by a specified number of translates of an ellipsoid E. The algorithm is 
constructive and proceeds by constructing a simple parallelepiped tiling of K, where the parallelepiped in 
question is a maximum volume inscribed parallelepiped of E. 

Algorithm 3 Build-Cover: Deterministic construction of an ellipsoid covering of a convex body. 
Input: A weak membership oracle Ok for an (0, r, i?)-centered convex body K, an ellipsoid E = E{A), 
and some H > 1. 

Output: Either a covering of K by (-v/Svreff)" translates of E, or a declaration that K cannot be covered 
by copies of E. 

1: Let C^; be any maximum- volume inscribed parallelepiped of E (e.g., a maximum- volume inscribed 
cuboid with the same axes as the ellipsoid). 

2: Attempt to cover K using translates of Ce with respect to the natural parallelepiped tiling, via a breadth- 
first search over the tiling lattice, starting from the origin. 

3: If the attempted covering grows larger than (-v/Svrei/)", abort. Otherwise, output the covering. 
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Theorem 3.8. Algorithm\3\( Build-Cover) is correct, and runs in time (VSvre-ff)" • poly(n, (^), log(-^)). 

4 Lattice Algorithms 

In this section we prove our general enumeration theorem for convex bodies (Theorem 11.11 formalized in 
Theorem |4.2| ) and give its application to the Shortest and Closest Vector Problems, and Integer Programming. 

4.1 Lattice Background 

An n-dimensional lattice L C is a discrete subgroup under addition. It can be written as 

i= jj^zA : e z| (4.1) 

for some (not necessarily unique) basis B = {bi, . . . ,bk) of k < n linearly independent vectors in M". The 
determinant of L is defined as 

det(L) = y^deUBiB). (4.2) 

The dual lattice L* of L is defined as 

L* = {y£ span(5i, . . . , 6^) : Vx G L, (x, y) G Z}. (4.3) 

The minimum distance of L with respect to K is \i{K, L) = miiij^gj^^jo} Hj/H/c- The covering radius 
of L with respect to K is ^(i^, L) = inf{s > : L + sK = R"}. Note that from the definition, we see 
that ^i{K + t,L) = fi{K,L) for t G R" and that fi{-K,L) = fi{K,L). We also define dK{L,x) = 
infygilly — We define the i*^ minimum of L with respect to the £2 norm as 

\i{L) = inf{r > : dim(span(r5^ n L)) > i} 

where span denotes the linear span. 

The shortest vector problem (S VP) with respect to K is the following: given a basis of an n-dimensional 
lattice L, compute an element of 

SVP(i^,L) = argmin ||y||i^. (4.4) 

yeL\{0} 

The closest vector problem (CVP) with respect to K is: given a basis of an n-dimensional lattice L and a 
point X G M", compute an element of 

CVP(iir, L, x) = argmin ||y — x||ii-. (4.5) 

To denote the sets of approximate minimizers for SVP and CVP, we define for any e > 

SVPe(i^,L) = {z G L\{0} : ||z||;^ < (1 + e) • min||y||/^} (4.6) 

y&L\{0} 

CVP,(K, L,x) ={z£L: \\z - x\\k < (1 + e) • min||y - x\\k}. (4.7) 

yeL 
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Integer programming. A fundamental tool in integer programming is the so-called "flatness theorem," 
which says that for any convex body K CW^ and n-dimensional lattice L C R", 

1 < ^,{K, L) ■ Ai((K - K)\L*) < f{n), (4.8) 

where fi{K, L) = inf{s > : L + sK = M"} is the covering radius of L, and 

\i{{K-K)\L*)= inf (sup(x,y)- inf 
J/eL*\{0} ^ xdK xdK 

is the lattice width of K. The flatness theorem is most easily interpreted as follows: either K certainly con- 
tains a lattice point in L, or there exist at most [/(ra)J +1 hyperplanes of the form H}^ = {x G M" : (y , x) = /c}, 
y ^ L* \ {0}, A; G Z and inf^^gft- {y, x) < k < sup^g^^ {y, x), such that any lattice point in K must lie on 
one of these hyperplanes. Crucially, we note that computing Xi{{K — K)*,L*) for a general convex body 
K is exactly a shortest non-zero vector computation with respect to a general norm. 

The asymptotic growth (and even the finiteness) of the function /(n) in ( 14.81 ) has been the source of 
intense study over the past century. Restricting to the important special case where K = B2, the optimal 
growth rate has been settled at f{n) = Q{n) [Ban93] . When K is centrally symmetric, the best known 
bound is /(n) = O(nlogn) ||Ban96i For the general case, the current best bound is f{n) = 0{ns log^ n) 
HELPS 99[ IRudOOB for some fixed c > 0. We let /*(n) denote best possible upper bound for the general 
flatness theorem. 



4.2 Lattice Point Enumeration in Convex Bodies 

We now use enumeration via the M-ellipsoid covering to solve the Shortest and Closest Vector Problems. 
To do this we will need the recent algorithm of Micciancio and Voulgaris HMVlOl for the Closest Vector 
Problem under the £2 norm (and hence any ellipsoidal norm), which we call the MV algorithm for short. 
The following is an immediate extension of their graph-traversal approach IIVoul . 

Proposition 4.1 ( HMVIOI . Algorithm EUipsoid-Enum). There is an algorithm Ellipsoid-Enum that, given 
any positive definite A S Q"^", any basis B of an n-dimensional lattice L C M", and any t S M", computes 
the set L n {E{A) + t) in deterministic time 

. (|L n {E{A) + t)\ + l)- poly((A>, {B), {t)). (4.9) 

Here the idea is that the points inside {E{A) + 1) n L form a connected subgraph, where we consider two 
lattice points adjacent if they differ by a Voronoi-relevant vector of L, where Voronoi relevance is defined 
with respect to the inner product defined by A (see [MVIO] for formal definitions). An initial point inside 
{E{A) + t) n L can be computed (if it exists) in a single call to the MV algorithm, and the rest can be 
computed by a standard breadth-first search of the graph. 

For a convex body C and a lattice L C R" define 

G(K,L) = max |(K + x)n LI, (4.10) 

the maximum number of lattice points in K under any translation. 

We can now state our enumeration theorem, which formalizes Theorem 11.11 from the introduction. 
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Algorithm 4 Algorithm Lattice-Enum(i^, L, x, d, e) 

Input: An (0, r, i?) -centered convex body K presented by a weak distance oracle Dk for a basis B 

for a lattice L, an input point x, distance d> 0, and < e < 1. 
Output: SOL satisfying (gH]). 

1: Let {E, T) ^ M-Ellipsoid(K) c> This covering need only be computed once for repeated calls. 

2: Let 5 ^ 

3: for all s e r do 

4: Let Us ^ Ellipsoid-Enum((i-E', L,x + ds) 

5: S[J{y:y(^Us,DK{y-x,l^)<d+^] 

6: return S 



Theorem 4.2 (Enumeration in convex bodies). Algorithm^(Lattice-Enum) outputs a set S C L such that 
{y e L -.Wy - x\\k < d} Q S (1 {y e L : \\y - x\\k < d + e} (4.11) 
in expected time G{dK, L) ■ 2^(") • poly(log(f ), log(i), (B), (x)). 
Proof. 

Correctness: We first note that K C U^gT s + E then x + dK C Usgj- x + d{s + ii^). Hence given a 
covering for we have a covering of dK + t. Now on input (d-B, L, x + ds) the algorithm EUipsoid-Enum 
returns the set {x + ds) + dE r\ L = x + d{s + E) r\ L. 

Now we first show that for all y G x + dK n L, y £ S. By the covering property, we know that 
for some s G T, y G x + {s + E) n L. Finally, by the properties of the weak-semi norm oracle since 
y G dK + X <^ \\y — t\\K < d, we have that 

Dxiy -x,^) < \\y - x\\k + I - ^ + I' 

and hence y is correctly placed in 5 as needed. Lastly, we must show that if y ^ {d + e)K + x 4^ \\y — t\\ > 
d + e, then y ^ S. Again, from the properties of the weak distance oracle we see that 

Dxiy -x,^)> \\y - x\\k -^> d + e-^ = d+^ 

as needed. Lastly, by construction, the set S only contains lattice points, and so by the above arguments U 
satisfies the required properties. 

Runtime: By Theorem l3.5[ M-Ellipsoid computes an M-ellipsoid in expected time polylog(— )Cp. Let E 
denote an M-ellipsoid of K and let T C M" be as above. From Theorem 13.51 we know that \T\ < C2 , hence 
the algorithm makes at most calls to Ellipsoid-Enum. Now to bound the complexity of enumerating 
X + d{s + E) n L for each s G T, we need to bound \x + d{s + E) n L\ < G{dE, L). Now we note that 

G{dE,L) < N{dE,dK)G{dK,L) = N{E, K)G{dK, L) < C^G{dK,L) 

by Theorem |3.5l Hence for any s G T, Ellipsoid-Enum takes at most C3 poly((i?), (x)) {C2G{dK, L)) < 
poly((i?), (x)) C4 G{dK, L) time to compute x + d{s + E) n L. Hence the total running time is bounded 
by 

polylog(f ) + poljiiB)) C2 G{dK, L) < poly(log f , {B),{x)) G{dK, L) (4.12) 
where C5 > is an absolute constant. □ 
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We remark that the only randomness in the algorithm is to build the M-ellipsoid; once this has been 
achieved the rest of the algorithm is deterministic. Hence, in the cases where the M-ellipsoid is known 
explicitly, as it is for the balls (where an appropriately scaled Euclidean ball suffices), the algorithm can 
be in fact made completely deterministic. The algorithms for the shortest vector and closest vector problem 
described in the next sections will only depend on the Lattice-Enum algorithm, and hence they will be 
deterministic as long as Lattice-Enum is deterministic. 



4.3 Shortest Vector Problem 

Our main goal will be to use the above enumeration algorithm to solve the Shortest Vector Problem. The 
following gives a useful bound on G{K, L) for a general convex body. 

Lemma 4.3. Let K (1 be a convex body satisfying yo\{K n —K) > 7"" vol(i^), 7 > 1, and let L be 
an n-dimensional lattice. Then for d > we have that 

We note 7 above is easily bounded in many natural situations. When K is centrally symmetric we can 
set 7 = 1 since K n —K = K, and if K is a general convex body with h{K) = setting 7 = 2 is valid by 
Theorem lA.il Hence the notion of "well-centered", i.e., 7 < 4, is quite robust. 

Proof of Lemma W3\ Let s = ^\i{K, L). For 2; G L, we examine 

X + int(s(i^ n -K)) = {z G M" : \\z - x\\Kr^~K < s}. 

Now for X, y S L, 2; 7^ y, we claim that 

X + mt{s{K n -K)) ny + mt{s{K n -K)) = (4.14) 

Assume not, then 3 z E M" such that \\z — x\\Kn-K, \\z — y\\Kn-K < s. Since K n —K is symmetric, we 
note that \\y — z\\Kn-K = \\z — y\\Kn-K < s. But now, since K n —K C K, we see that 

\\y-x\\K = \\y - z + z - x\\k < \\y - z\\k + \\z-x\\k 

< \\y - z\\Kn~K + \\z - x\\Kn-K < s + s = 2s = Xi{K,L) 

a clear contradiction since y — x 0. 

Take c E M". To bound G{dK, L) we must bound |(c + dK) n L\. For x E c + dK, we note that 
X + s{K n -K) C c + (d + s)K. Therefore, 

yo\{{d+s)K) = wo\{c+{d+s)K) > vol (((c + dK) n L) + s{K n -K)) = \ {c+dK)r\L\ vol{s{Kr\-K)) 

(4.15) 

where the last equality follows from ()4.14p . Therefore, we have that 

as needed. □ 
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Algorithm 5 Shortest- Vectors (K, L, e) 



Input: A (0, r, i?)-centered convex body K presented by a weak distance oracle Dk for ||-||a'> a basis B 

for a lattice L, and < e < 1. 
Output: 5 C L such that SVP(i^, L) C 5 C SVP,(K, L) 

1: Compute z G SVP(S^, L) using the MV algorithm. Set t, d ^ 

2: repeat 

3: [/ ^ Lattice-Enum(K, L, 0, d, t) \ {0} 
4: if [/ = tiien 
5: 2d 
6: until [7/0 

1: U ^ Lattice-Enum(if, L, 0, d + t, t) \ {0} 
8: m ^ min{L»A'(y, f t) : y G U] 
9: 5^{y:Z)i^(y,ft)<m+f t,yGC/} 
10: return S 



We can now state the algorithm and main theorem of this section. 

Theorem 4.4 (Correctness of Shortest- Vectors). If K is well-centered, i.e., yo\{K n —K) > 4~" vol(K), 
then Algorithm\5\( Shortest-Vectors) outputs a set S L satisfying 

SVP(K, L) C 5 C SVPe(K, L) (4.17) 

in expected time 

20W-poly(log(f),log(l),(i?)). (4.18) 

Proof. 

Correctness: First note that since K is (0, r, i2)-centered, we know that < ||y || a' < for all y G M". 

Now take z G SVP(i^, L) and 2:' G SVP(52 > Let w = H^Ha, and as in the algorithm let t = Now 
we have that 

lU'll WzW Wz'W R 

i = ^ < V < Iklk < Ik'lk < ^ = i- (4.19) 
R R J. J. 

Therefore t < uj < t—. 

— — J, 

Now for z G SVP(i^', L), we must show that z G 5. Let df denote the final value of d after the 
while loop terminates. Since C/ / and ^ U after the while loop terminates, and since the enumeration 
algorithm guarantees that U C {y £ L : \\y — x\\k ^ df + t}, we have that u < df + t. Now let C/j = 
Lattice-Enum(Er, L,0,df -\-t,t)\ {0}, i.e. the final setting of the set U. By the properties of Lattice-Enum, 
we know that {y G L : ||y — x\\k < c?/ + i} C Uf, and hence we have that SVP(K, L) C Uf. From the 
computation of the number m, during the final stage of the algorithm, we now see that a; — |t < m < a; + |t. 
Therefore for z G SVP(i^', L), we have that 

DK{z,^t) <u} + ^t<m + U (4.20) 

and hence z will correctly be placed in 5 as needed. 

Now assume that z £ L\ {0} and z ^ SVP(i^, L)^. We must show that z ^ S. Since 00 > t from above, 
we have that \\z\\k > (1 + e)uj > a; + et. Therefore, we see that 

Dk{z, ^t) > \\z\\k - > u + ^t>m + (4.21) 
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and hence z will never be added to S as needed. 



Runtime: First we run MV to compute an element of SVP(i?2 > which takes poly((i?), (x))2'^(") time. 
Next since co > t (u, t as above), we have that Xi{K, L) > t. Now the enumeration algorithm is seeded with 
d = t < \i{K, L). From here we see that the moment d is pushed above Xi{K, L), the set U returned by 
Lattice-Enum will be non-empty. Hence during the execution of the while loop, the value of d is never more 
that 2Xi{K, L). Furthermore, the last execution of the enumeration algorithm is run ond + t < 3Xi{K, L). 
Hence every run of the enumeration algorithm happens for distances less than ?>Xi{K,L). Therefore by 
Lemma 1431 and Theorem ll.il we have that each run of the enumeration algorithm takes at most 

polylog(|, \) poly((i?)) C" G{?,X^{K,L)K,L) < polylog(|, \) poly((S)) (4 • 7)" (4.22) 

Next, since t < uj < ty, we see that we will execute the enumeration algorithm at most log2 y + I times. 

Ilz'll 

Remembering that t = we have that all the lattice points of L generated by the algorithm lie inside a 
ball of radius at most 3 -p ||z'|| < 3 a/^II-^II around x. Hence, these lattices points as well as the number 
t can be represented using at most poly{{B), (x),ln(-p)) bits. Therefore, apart from in the enumeration 
algorithm, we only evaluate the weak norm oracle on inputs of size poly((i?), In(^), (x),ln i) which is 
polynomial in the input. Finally, we filter the list Uj into S, which requires exactly 2\Uf\ evaluations of the 
norm-oracle, where the cardinality of Uf is bounded by (14.221 ). Combining all of the above bounds, yields 
the desired result. □ 



4.4 Closest Vector Problem 

Before presenting our CVP algorithm, we again need a simple enumeration bound. 

Lemma 4.5. Let K C M" be a convex body, and let L C denote an n-dimensional lattice. Then for 
t > Qwe have 

G{tK, L) < {At + 2)" • G{K, L) (4.23) 

Proof. Since G{tK, L) is invariant under shifts of K, we may assume that b{K) = 0. Since h{K) = 0, 
from UMPOOI we know that vol(K) < 2" yo\{K n -K) (Theorem (IbIJ]) ). We remember that N{tK, K n 
—K) denotes the minimum number of translates of K r\ —K needed to cover tK. Since K r\ —K i?, 
symmetric, by a standard packing argument we have that 

N{tK,Kn-K) < ^ -< ^ 2 J 



vol(i(K n -K)) ~ voliliK n -K)) 

(4.24) 



1 \ 

' + < (2i + 1)"2" = (4t + 2 



vol(i^ n -K) 



Next since K n -K C K, we have that N{tK, K) < N{tK, K n -K). Now let A C M'' denote a set 
satisfying | A| = N{tK, K) and tK C jj^^^ x + K. Then for c G we have that 

\tK + cr\L\<\{K + c + K)r\L\<^\{x + c + K)r\L\ 

xeA (4.25) 
< I A| • G{K, L) = N{tK, K) ■ G{K, L) < {At + 2)" • G{K, L) 

as needed. □ 
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Algorithm 6 Closest- Vectors (K, L, x, e) 

Input: An (0 , r, i?) -centered convex body K with weak distance oracle Dk for | | • | | , a basis B for a lattice 

L, an input point x, and < e < 1. 
Output: SQL, CYF{K, L,t) Q S Q CYF,{K, L, t) 

1: if x G L tiien 

2: return {x} 

3: Compute z £ CVP(5^, L) using the MV algorithm. Set t,d^ ^^ 
4: repeat 

5: [/ ^ Lattice-Enum(K, L,x,d,t) 
6: if ?7 = then 
7: d^2d 
8: until ?7 / 

9: U ^ Lattice-Enum(Er, L,x,d + t, t) 
10: m ^ min{L'ft:(y — x, |t) : y € ?7} 
11: 5^ {y : Z)i^(y-x,|t) < m+ f t,y G [/} 
12: return S 



We can now state the algorithm and main theorem of this section. 

Theorem 4.6 (Correctness of Closest- Vectors). If K is well-centered, i.e., vol(K n —K) > 4~"vol(K), 
then Algorithm^coniputes a set S Q L such that 

CYF{K, L,x)QSQ CYPe{K, L, x) (4.26) 

in expected time 

2^^ • G{dK, L) ■ poly(log(i), log(f ), {B), (x)), (4.27) 

where d = dxiL, x). 

The proof is essentially identical to the one for SVP. 
Proof. 

Correctness: If x G L, clearly there is nothing to do, so assume x ^ L. First note that since K is 
(0, r, _R)-centered, we know that < \\y\\K < for all y £ R". Now take z G CVP(iv:, L,x) and 
z' £ CYP{B2 , L, x). Let uj = \\z — x\\k, and as in the algorithm let t = Now we have that 

llz' — xll llz — xll ,, ,, ,, , ,, llz' — xll R 

t = - — =— ^ < ^ < \\z - x\\k < \\z - x\\k < = t— (4.28) 

R R r r 

Therefore t < uj < t-p. Now for z G CVP(K, L, x), we must show that z £ S. Let df denote the final 
value of d after the while loop terminates. Since U ^ % after the while loop terminates, and since the 
enumeration algorithm guarantees that U Q {y £ L : \\y — x\\k < df + t}, we have that ui < df + t. Now 
let Uf = Enumerate(-R', L, x, df + t, t), i.e. the final setting of the set U. By the properties Lattice-Enum, 
we know that {y £ L : \\y — x\\k 1^ df -\-t} Q Uf, and hence we have that C\Y'{K, L, x) C Uf. From the 
computation of the number m, during the final stage of the algorithm, we now see that — |t < m < a; + |t. 
Therefore for z £ GYP (if, L,x), we have that 

Dk{z - x,^t) <uj + <m + ^t (4.29) 
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and hence z will correctly be placed in S as needed. 

Now assume that z ^ L and z ^ C\Y'{K, L, x)^. We must show that z ^ S. Since uj > t from above, 
we have that Hz — x||i^>(l + e)ijj > uj + et. Therefore, we see that 

Dk{z - X, ^t) > \\z - x\\k - ^t> oj + ^t>m + U (4.30) 
and hence z will never be added to S as needed. 



Runtime: We first check if x G L, this take poly((i?), (x)) time. Next, we run the MV algorithm to 
compute an element of CVP(i32 > L, x) which takes poly((S), (x))2*^(") time. Next, note that since oj >t 
(io,t as above), we have that dK{L,x) > t. Now the enumeration algorithm is seeded with d = t < 
dxiL, x). Now we note that the moment d is pushed above dxiL, x), the set U returned by the enumeration 
algorithm will be non-empty. Hence during the execution of the while loop, the value of d is never more 
that 2dK{L, x). Furthermore, the last execution of the enumeration algorithm is run on d + t < Sd^iL, x). 
Hence every run of the enumeration algorithm happens for distances less than 3dK{L,x). Therefore by 
Lemma [43] and Theorem |4.2[ we have that each run of the enumeration algorithm takes at most 

polylog(-, I) poly((i?)) Gi3dK{L,x)K,L) 



r'f 



< polylog(^, poly((i?» 14"G(d;^(L, x)K, L) (4.31) 



Next since t < a; < t-^, we see that we will execute the enumeration algorithm at most ln2 + 1 times. 

\\z' ~x\\ 

Now remembering that t = " „ " , we see that all the lattice points of L generated by the algorithm lie 
inside a ball of radius at most 3^||z' — x||<3-^ \/n||-B|| around x. Hence, these lattices points as well 
as the number t can be represented using at most poly((i3), (x), In(-p)) bits. Therefore, apart from in the 
enumeration algorithm, we only evaluate the weak norm oracle on inputs of size poly((i3), hi(-^), (x) , hi 
which is polynomial in the input. Finally, we filter the list Uf into S, which requires exactly 2|?7j| evalu- 
ations of the norm-oracle, where the cardinality of C/j is bounded by (14.311) . Combining all of the above 
bounds, yields the desired result. □ 

Though the runtime of the Closest- Vectors algorithm cannot be bounded bounded in general due to the 
G{dK, L) term, its running time can be controlled in interesting special cases. For example, if K is well- 
centered and dxiL, x) < aXi {K, L), i.e. the target point is relatively close to the lattice, then by Lemma l43] 
the main complexity term of the Closest- Vectors algorithm on K,L,x becomes 

GidK{L,x)K,L) < (^4(l + ^|^^y < (4 + 8a)" (4.32) 

which is of order 2'^^"^ when a = 0(1). With this bound, we recover (up to large C" factors) the running 
time of the AKS sieve for exact CVP when the target point is close. 



4.5 Integer Programming 

In this section, we present an algorithm for integer programming feasibility based on a general norm SVP 
solver. Relying on the best known bounds for the flatness theorem (see Equation 14.81) . we show that our 
algorithm achieves a modest improvement in complexity of IP. For a brief history, the first fixed dimension 
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polynomial time algorithm for integer linear programming is due to Lenstra in IILen83ll which achieved an 
essential complexity is 2*^^" \ This was dramatically improved by Kannan in [KanSVl reducing the com- 
plexity to 0(n^-^)". The next improvement is due Koppe and Hildebrand I HKI OI reducing the complexity 
to 0(n^)" while generalizing to feasible regions defined by quasi-convex polynomials. Here we present 
an algorithm which runs in 0{n3 log'^^^^ n)", for feasible regions equipped with a strong separation oracle 
(see Definition IB .21) . 

Let f*{n) denote the optimal function for the flatness theorem. Our main result here is as follows: 

Theorem 4.7 (Integer Programming). Let K C RB2 be a convex body given by a strong separation oracle 
SEPk- Let L C M" be a n-dimensional lattice given by a basis B G Q"^". Then there exists an algorithm 
which either decides that K D L = (!>, or returns a point x & K L in expected time 

0{nn)rpoly{{R),{ao),{B)) 

Unfortunately, the algorithm described above is not agnostic to the value of /*, its exact value (or 
any known upper bound) is needed in the code of to guarantee the algorithm's correctness. Hence using 

the best known bounds on /*(n) (see IIBLPS991 IRudOOl ). we get an algorithm of essential complexity 

4 

(cins log'^^ n)" for absolute constants ci, 02- 

We give an outline of the algorithm. The algorithm works as almost all previous IP algorithms do, i.e. by 
finding a "thinnest" width direction of K with respect to L. More precisely, we adopt a recursive solution 
strategy, where given K and L as above, we seek to find a small collection of parallel hyperplanes Hj., 
k ^ A, such that if K HL (/} then for some k Awe have that K CiLn 7^ 0. At this point, we simply 
solve the integer program with respect to K n Hk, L n Hk recursively for each k ^ A, and decide that KnL 
is empty if all the subproblems return empty and return any found lattice point otherwise. As we will explain 
below, finding the above set of hyperplanes reduces to solving a shortest vector problem with respect to a 
general norm, in particular the "width" norm of K, i.e. = ^^PyeK {u^^) ~ iiifyeA" {y,^)- In 

previous IP algorithms, the alluded to SVP problem is solved only approximately via a reduction to £2 (i.e. 
via an ellipsoidal approximation of the norm). The main source of improvement for our algorithm comes 
from the fact the we solve the associated SVP exactly using a general norm SVP solver. 

Proof of Theorem \4.7\ 
IP ALGORITHM: 

Basis Refinement: As a first step, we will reduce to working with a lattice admitting a basis of length at 
most 2^/nR. This will allow us to control the encoding length of the basis after each recursive invocation 
of the IP algorithm. To begin, we use the MV algorithm for CVP to compute a closest vector p G L to 
ao in the I2 norm. If ||p — aolb > ^ we declare that K D L = $ (since K (1 qq + RB2). Otherwise, 
we again use the MV algorithm to compute linearly independent lattice vectors vi, . . . ,Vn achieving the 
successive minima of L, i.e. where \\vi\\2 = Xi{L). Both invocations of the MV algorithm here take at most 
2'-'(") poly((i?)) time. Letting vo = 0, compute the largest index k, < k < n, such that \\vk\\ < 2R. Now 
let L' = L n span(t'o, vi, . . . , Ufc). 

Claim: L n ao + RB'^' '^p + L'. 
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Proof. Take y G L n + RB2- Since p E ao + i2i?2> we have that \\y — p\\2 < 2R. Assume that 
y —p ^ span(fo, vi, . . . , Vk)- Since y —p £ L and y — p is Unearly independent from vo,vi, . . . , Vk, we get 
that Afc+i(L) < 2R. But by our choice of k, we know that Xk+i{L) > 2i2, a clear contradiction. Therefore 
y — p £ L n span(vo, vi, . . . ,Vk) H L = L', as needed. □ 

Since K C ao + RB2, from the above claim we get that it suffices to check whether K — pr\L' = $ to 
solve IP feasibility with respect to K and L. Now using standard techniques (Chris: reference needed), we 
may compute a basis B' for V using vq, vi, . . . , ffc sastifying ||-B'||2 < V^H^fclb < 2VkR in polynomial 
time. Let W = span(L') denote the linear span of L', Cq denote the orthogonal projection of oq — p onto 
W, and let R' = ^ R? — ||ao — a'oP- ^^^y check that K — p r\W \s (cq, ii') -circumscribed in W . 
Given that may restrict our attention to points in K — p n L', for the rest of the algorithm we replace L by 
L' , K\yj K — pr\W (for which a strong separation oracle is readily available via Lemma lBTTl ). and (oq, i?) 
by (a'o,i?')- 



Localizing K: For the next step, we compute a strong enough ellipsoidal approximation of K to begin 
inferring about how K interacts with L. To do this, we use algorithm GLS-Round (Theorem lB.51 ). running 
against K with parameter e = (^)"det(L) to deterministically compute an ellipsoid E + t such that 
either (1) vol(£^) < e (i.e. E is tiny compared to the 'sparsity' of L), or (2) E sandwiches K well, i.e. 
i + ^/ I n -^ C C t + This step can be done in poly(n, log -) = poly(n, (R), (det(L))) time. 

Branching on a "thinnest" width direction of K: Here we wish to find a dual vector y £ L* , such that 
there exists a small number of hyperplanes of the form H]^ = {x : {x, y) = k}, k £ A (1 2,, with the 
property that if K contains a point of L then there exists a lattice point in n ii' n L 7^ for some k £ A. 
At this point, as explained previously, we recurse on K n Hf^, L n H^, for all A; G ^. To implement such 
a recursive call for a specific H^, k € A, we compute a basis for L n Hq and a point p G Hk n L, and 
call the IP procedure on K — pCi Hq and L n Hq. All the preprocessing here can be done in polynomial 
time via standard methods, where as above we note that a strong separation oracle for K — pH Hq is readily 
computable via Lemma IbTtI 

Now to find such a y and set A, we proceed as follows. If we are in case (1) above, we use the MV 
algorithm to compute a vector y G SVP(£'*, L*), which can be done in 2*^^") poly((i3)) time. Noting that 
{E - E)* = \E*, we see that 

wo\{{E-Ef) = (-\ Yo\{E*) = (-\ vol(BJ)2— 1— > ^ ^ 



2) ^ ' \2) ^ Yo\{E) \2n) yo\{E) 
Given that vol(£^) " < e = 4^ det(L)", from the above we see that 

vol((S - E)*)^ > ^ > 2 ^—^ = 2det(L*)^ 

2nvol(E)n det(L)n 

Since {E — E)* = ^E* is centrally symmetric, by Minkowski's first theorem (Theorem IB. 101 ) we have 
that 2||y||£;. = \\y\\(E-E)* = Mi^ - E)*,L*) < 1. We remember that = sup^.^^; (y, x) - 

infx£E {y, x) is the width of E with respect to y. Since y G L* we note that for any x G ii^ + 1 n L, we must 
have that {x, y) G ((y, t) + [inf^^g^; (y, x) , sup^.g^ (y, x)]) fl Z. Since E has width < 1 with respect to y, it 
is easy to see that if £' + 1 n L is non-empty then all the lattice points in E + tr\L must lie on the hyperplane 
ii = {x G M" : (x, y) = [t\ }. Since i^T C £) + t, it is also clearly the case that K r\ L (1 H r\ L.To finish 
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with this case, we now recursively solve the Integer Program with respect K D H and L (1 H, returning 
empty iff K n L n = 0. 

If we are in case (2), we know K is well-sandwiched by E, i.e. t + -^^^^^^^E Q K <^ t + E. To find 
a thin direction for K, we shall compute y G SVP((i^ — K)*,L*, 1). To do this, we must build a weak 
distance oracle for {K — K)* . Given that K is well sandwiched by E, using the Ellipsoid Method (theorem 
IB.4I ). for any y € Q" and e > 0, we may compute l,u £ Q satisfying 

^ - < inf {y, x) < I u < sup {y, x) < u + ^ 

2 xGK xdK 2 

in polynomial time. We note now that 

\\\y\\(K-K)* - (^^-01 = I sup(y,x) - inf - {u - l)\ < e 

as needed. Next, the SVP algorithm needs sandwiching guarantees on {K — K)* . Given our guarantees on 
K, we see that \E* = {E - E)* C K - K C ^{n + l)^/nE*. Technically, the algorithm Shortest- Vectors 
requires the sandwiching ratio with respect to euclidean balls, but this type of sandwiching is equivalent to 
ellipsoidal sandwiching after linear transformation. Having constructed a weak distance oracle for (K — K)* 
and computed the sandwiching guarantees, we may now call Shortest- Vectors(( A' — K)*, L* , 1) (Theorem 
14.41) and retrieve y £ L* from the output. Since the sandwiching guarantees are polynomial in n and the 
required accuracy is 0(1), this call be executed in expected time 2*^^") poly((i?), (E)) time. Using the 
Ellipsoid Method (theorem IB. 41 ) as above, we compute bounds u,l £ Q satisfying u < sup^-g^ (y, x) < u + 
1 and / — I < mix(^K {y, x) < I in polynomial time. Now compute A = [l — l, min{ti + 1, / + f*{n) + l}]n 
Z. We now show that it suffices to restrict our attention to the hyperplanes Hj. = {x G : {x, y) = k} for 
keA. 

Claim: If A n L / 0, then there exists x £ K r\ L such that (y, x) £ A. 

Proof. First, if / + f*{n) + 1 > sup^g^ {y,x), then by our guarantees on u and / we have that A 5 
[inf j^gft: {y, x) , sup^.^^ (y, x)] n Z. Since (y, x) G Z for any x e L, we clearly have that x € K n L ^ 
{x, y) € A. Next, if / + /*(n) + 1 < sup^g^^ (y, x), then we have that 

r(n) < sup(y,x) - / - 1 < - 1 < \i{{K - K)\L*) 

by our assumption that y G SVP((Ar — K)*,L*, 1). Take xq G arg min^.g^ {y, x) and examine the convex 
body 

\\y\\{K-K)*J \\\y\\{K~K)*J 

Since xq G A and f*{n) + 1 < we get by convexity that K (1 K. Furthermore, we can see that 

A C {z G M" : inf (y, x) < {z, y) < inf {y, x) + f*{n) + 1}. 
x&K x&K 

Therefore any x G ATlL must satisfy (x, y) G A. Hence if KnL ^ 0, since K Q K there exists x G KnL 
such that {y, x) G A. We now show that A n L 7^ to complete the claim. 
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By homogeneity, we see that 
M(K - KT.L-) = A. ((f^ iK - ,<))' , L') = (/•(„) + 1) ^■(('^- - "^•■'•^ 



y\\(K-K)* J J \\y\\{K-KY 

\\y\K-KY r{n) + i 

Applying the flatness theorem to K, we now get that fj.{K, L) < 1 and hence that K n L / as needed. □ 

Given the claim, we may complete the algorithm by recursively solving the integer programs with respect 
to K n Hk and Ln Hk, for all k e A. We return EMPTY if all calls return EMPTY, and return any found 
lattice point otherwise. 

RUNTIME: The correctness of the algorithm has already been discussed above, so it only remains to 
check that the runtime of the algorithm is bounded by 0(/*(n))" poly((ao), {R), {B)) on expectation (we 
note that the only source of randomness in the algorithm comes from the calls to the Shortest- Vectors al- 
gorithm). The algorithm above is recursive, where at each node of the recursion we perform the 3 named 
procedures above and then break the problem into at most [/*(n)] + 2 subproblems which we solve recur- 
sively (the calls to IP on KriH^, LnHf^ as above). Now if we can show that the processing at each recursive 
node takes at most expected 2*^^") poly((ao), {R), {B)) time - where ao, R, B are the original parameters 
provided to the top level call of the IP algorithm - then by solving a standard recurrence relation we get that 
the whole running time is indeed 0(/*(n))" poly((ao), (R), (B)) on expectation as needed. 

Let us examine a specific recursion node with associated convex body K, (ao, ^)-circumscribed in 
M", and n-dimensional lattice L with basis B. Now it is straightforward to see that at this recursion node, 
the amount of computation is certainly bounded by 2'^^") poly((ao), (R), (B)) on expectation, since the 
above procedures only make calls to subroutines with either polynomial runtimes (such as the GLS -Round 
algorithm, the Ellipsoid Method, and standard linear algebraic procedures) or single exponential runtimes 
(such as the MV algorithm and the Shortest- Vectors algorithm). The main issue is therefore whether the 
lattice basis and affine subspace passed to the next level recursion nodes have bit size bounded by a fixed 
polynomial (i.e. whose degree does not depend on n) in the size of the original parameters. For clarity, 
we only sketch the argument here. The main reason this is true is because of the Basis Refine step. Most 
crucially, after the refine step, we end up with a lattice basis whose length is bounded by 2\ffLR < 2^/nR. 
Since Z is a sub-lattice of our original lattice L, it is not hard to verify that any vector of L (and in fact of L) 
of length less than l^fnR has bit size bounded by poly((i?) , {B)) (for a fixed polynomial). Hence the Basis 
Refine step "smooths" any incoming basis and subspace to ones whose bit description is well bounded by the 
original parameters. Since the bit description of the lattice basis and subspace passed to the next child node 
is only a fixed polynomial larger than that of the "smoothed" basis after our refine step, the claim follows. 
The runtime is therefore bounded by 0{f*{n))^ poly((ao), {R), {B)) on expectation as desired. □ 
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A M-EUipsoid Proofs 

Here we prove correctness of the all the main M-ellipsoid algorithms from Section [3l We rely heavily on 
several geometric estimates, which are listed and proved in S ection IATT] below, and on standard algorithms 
from convex optimization and convex geometry, which are described in Section IB31 

Proof of Theorem [531 ( Correctness of M-Ellipsoid). Here we give more detail as to the implementation of 
each of the steps of Algorithm [TJ 



Step 1: Make a direct call to algorithm Estimate-Centroid (Lemma [B. 91 ) on K. 

Step 2: If Estimate-Centroid returns an estimate b of b{K), we have the guarantee that 



b + 



2(n + l)VH 



<Z K <^b + 2R 



(A.l) 



Since the guar antees about 6 in are polynomial in the input, we can build a weak membership oracle 
Ox-b for K — b, where — 6 is (0, 2{n+i)y/n ^ 2i?) -centered, in polynomial time from Ok- Now we 
run the algorithm of Theorem 13. 7 1 on the oracle Ox-b and retrieve the tentative M-ellipsoid E{A) of 
K. 

Step 3: Here we make a direct call to the algorithm Build-Cover on (K, E{A)) where we ask whether 

N{K,E{A)) > (13e)". 

Step 4: First, we implement a weak membership oracle 0(^x-K)* for ~ K)* from Ok using the 
ellipsoid algorithm, where we can guarantee that {K — K)* is (0, t^^, ^)-centered. To do this, we 
note that 

X e{K - K)* -i?^ sup (y, x) - inf (y, x) < 1 
y(zK y&K 
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Hence we can build a weak membership oracle for {K — K)* by approximately maximizing and 
minimizing with respect to x over K. This can readily be done via the ellipsoid algorithm (see 
Theorem lB.4l) . The guarantees we get on {K — K)* are seen as follows: 

ao + rBl^ <Z K C RB^ 2rB^ QK-K Q 2RB^ ^B^ <^ {K - K)* C ^B^ 

Next, we note that E{A)* = E{A~^), and hence can be computed in polynomial time. Next, we call 
the algorithm Build-Cover on {{K - K)*,E{A)*) where we ask whether N{{K - K)*,E{A)*) > 
(25e • 13)". 



Correctness: We must show that if the algorithm succeeds, returning the ellipsoid E{A), that E{A) indeed 
satisfies 

N{K,E) < (^Vs^-UeY N{E,K) < (^VS^ -256 -IS- 289y (A.2) 

These guarantees depend only on the correctness of the algorithm Build-Cover. In, step 3, if the test passes, 
we are guaranteed to get a covering T of K by where \T\ < (-v/Svre • 13e) . Hence the first requirement 
is met. In step 4, if the test passes, we are guaranteed that N{{K — K)*,E*) < {4:y^ ■ 25e • 13)". Now 
by Theorem lA.2[ since E* is centrally symmetric, for n large enough, we have that 

N{E,K) < 2STN{{K - K)\E*) < (^\/87re • 25e • 13 • 289)" (A.3) 

as needed. 



Runtime: We note that of each the steps 1 — 4 already have a running time bounded by the desired runtime. 
Hence, it suffices to show that the main loop is executed on expectation only 0(1) times. To do this, we first 
condition on the event that in step 1, the returned estimate b satisfies that b — b{K) G ^^i^i^-. This occurs 
with probability at least 1 — ^- Next, in step 2, given that K — b satisfies the conditions of Theorem 13.71 
i.e. that b{K — b) = b{K) — 6 G :^^Ek, we may condition on the event that the returned ellipsoid E{A) 
satisfies 

N{K,E{A)) < (13e)" N{E{A),K) < (25e)". (A.4) 

Since this event occurs with probability 1 — -, our total success probability is 1 — -. Now in step 3, given 
that N{K, E{A)) < (13e)", the test is guaranteed to pass. Since E is centrally symmetric, for n large 
enough, we have that 

N{{K - Ky,E*) < (12(1 + o{lWN{E, K) < (25e • 13)". (A.5) 

Therefore, the test in step 4 is also guaranteed to succeed. Finally, we see that the probability that each 
execution of the loop terminates successfully is at least 1 — ^, therefore the expected number of runs of the 
loop is 0(1) as needed. □ 

Proof of Theorem \377\ ( Correctness ofM-Gen). The proof has two parts, first building the right oracle, then 
using it to sample and estimate the inertial ellipsoid. 



26 



Building a membership oracle for the polar: We first show that a polynomial time weak membership 
oracle for 5 = n {coiw{K, —K})* can be built from Ok- We note that 

V G n {conv{K, — K})* 44> max {sup {v,x) , sup {—v,x)} < n (A.6) 

xeK xeK 

Given the guarantees on Ok, we have that 

71 71 

-B^ C n (conv{i^, -K})* C -B^ (A.7) 

Constructing a weak membership oracle for S therefore requires only the ability to perform 2 different 
approximate optimizations over K. This can achieved using the standard optimization techniques described 
in Theorem IB .41 Hence, a polynomial time weak membership oracle for S can be built as claimed. 



Building the M-ellipsoid: Le tts denote the uniform distribution on S. Equipped with a weak membership 
oracle for S, we may use the sampling algorithm of Theorem IB .61 to sample a point Y £ S with distribution 
a satisfying dTy{a, tts) ^ :^ in tims poly(n) polylog(-p, n). Set s = Y, where Y is the computed sample. 
We shall use s to specify a reweighting of the uniform distribution on K. Let fg (x) = e^**'^^ for x S and 
otherwise. Using the algorithm described by Corollary IB. 8 1 we may compute a matrix A £ R"^" satisfying 

e~"% C E{A) C e^Ef^ (A.8) 

with probability 1 — - in time poly(n) polylog(— ). We return the ellipsoid ^/nE{A) as our candidate 
M-ellipsoid for K. 



Analysis: We now show that for n large enough, the ellipsoid returned by this algorithm satisfies with 
high probability the covering conditions 



N{K, V^E{A)) < (13e)" N{^/^E{A), K)) < (25e)" 



(A.9) 



First, we condition on the event dA.BI l. i.e. that we get a good estimate of Ef^. Hence at this point, our 
success probability is at least 1 — -. 

Let 77 > be a constant to be decided later. Let X be uniformly distributed on S, and let Y denote the ap- 
proximately uniform sample the above algorithm computes on S, remembering that S = n {coi\\{K, —K})*. 
Given the guarantee that b{K) G :^Ek, from Lemma |a3] setting e = 1, for n large enough we have that 



E[L 



2n ■ 
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(A. 10) 



Using Markov's inequality, we see that 



Pr 



IT 
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2n 
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2n ■ 



Now since dTv(-'^i ^) ^ n' 
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Lfy > (1 + Vf 
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2n 
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(A. 11) 



(A. 12) 
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for n large enough (r/ will be chosen to be constant). Hence after additionally conditioning on the comple- 
ment of event lA. 12l our success probabiblity is at least 1 — f ■ At this point, letting s = Y, we see that s 
specifies a density fs on K satisfying 

Lj^<{l + Vf^l^. (A. 13) 

Furthermore since s G n (conv{i^, —K})*, b{K) G ;^-E'x and Ek Q K, we have that 

'^PfJ^^i"^^ = sup e<^'--''(^)> = sup e<^'-)+<-^'M^)) < e^+\ (A.14) 

fs{b{K)) xdK x&K 

Hence by Lemma |A31 letting ^/nE{A) = T, and 5 = e™, we get that 

N{K,V^E{A)) < (125)" ^ 'TTJ/^S^^ ^ 12"e ^ e"+i < (12e(l + ??))" (A.15) 



and 



4 



iV(V^^(yl),i^) < (12(5^)" vol(V^SJ) - L 



3 



< 12" {V2^{1 + o(l)))" ^ ((1 + 7?)='V2)" < (24e(l + vff 



(A. 16) 



for n large enough. Choosing > such that (1 + ??)'^ = H yields the result. □ 

Proof of Theorem [Ol ( Correctness of Build-Cover). The goal here is to either compute a covering of K by 
E, or conclude that N{K, E) is large. To make this task easier, we will replace by a parallelepiped P 
inscribed in E, and use a tiling procedure (since P can be used to tile space) to cover K. We will show any 
cover produced in this way is not much larger than N{K, E), and hence will help provide a lower bound on 
N{K, E). Furthermore since P C E, any cover of K by P immediately translates into a cover of K by E. 

Building P: To compute P we will need to perform some standard matrix algebra. First we compute the 
Cholesky Factorization of A, i.e. we compute V G M"^" such that A = V^V. Next we compute B = V~^, 
the inverse of V, and label the columns of i? as i? = (6i, . . . , 6„). Both of the computations here can be 
done in time poly((^)) via standard methods. Now we note that 

{k, bj)^ = b\Ab, = {B'AB)ij = {V-'V'VV-% = (Idn).j. (A.17) 

Hence the vectors (6i, . . . , 6„) form an orthonormal basis of with respect to the dot product (•, •)^. Therefore 
the eUipsoid E{A) may be expressed as 

n 

E{A) = {x G M" : x*Ax < 1} = {x G M" : < 1}. (A. 18) 

i=l 

Now define P as 



P 



|x G M" : I {bi,x)j^ \ < = |^a,6i : \ai\ < , 1 < i < m| (A.19) 
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where the second equahty follows since the 6jS are orthonormal under (•, •)^. Now for x E M", we see that 

/ n \ 1/2 

max I {hi,x). \ < [Y^ {bi,x)\ ] < ^/n max | {bi,x)^ \ ^ P C E{A) C vnP. (A.20) 

l<i<n \ ^ — ' / i<i<n 

\i=l / 

Now a standard computation yields that 

2 ^^„..M-l/2 .,^u^jA,,^( ^(^+'^w) Vh..m^~v2 



vol(P) = ( ^ 1 det(A)-^/" vol(E(^)) = ' ^ ' " det(A)-^/" (A.21) 



where we remember here that det(i?) = det(y ^) = det(y) ^ = det(A) Therefore we have that 

vol(E(^))<(yf(l + o(l)))"vol(P). 



Tiling K with P: Define the lattice 

L = i ^ : G Z, 1 < i < m , (A.22) 



n 2 



so L is the lattice spanned by the vectors -^{bi, • • • , ftn)- From here it is straightforward to verify that P 
tiles space with respect to L, so L + P = M" and for x,y € L, x y, x + int(P) Hy + int(P) = 0, i.e. 
the interiors are disjoint. In fact, one can see that P is simply a shift of the fundamental parallelepiped of L 
with respect to the basis -^{bi, . . . , bn)- 

We now wish to tile K with copies of P. To do this we examine the set H = {x £ L : x + P H K ^ ill}. 
Since P + L = M", it is easy to see that 

K C H + P. (A.23) 

Hence, we shall want to decide for x G L, whether x + Pn IT 7^ 0. Since we only have a weak membership 
oracle for K, we will only be able to decide whether x + P approximately intersects K. To formalize this, 
we build an weak intersection oracle INT which queried on x G M", e > satisfies 

, , fO: x + PnA' = 
INT X, e = S • (A.24) 

^ ^ [1: x + (l + e)PnE:/0 

Using this oracle we will be able to overestimate T, and compute a set 5 C L such that 

C 5 C {x : X + (1 + e)P n -ft: / 0} (A.25) 
which will suffice for our purposes. Now to build INT, we first remark that for x G M", t > 

x + tPnK^(/}^ inf \\y - x\\p <t^ inf ^/n max | {bi,y - x)^ \ < t. (A.26) 

y£K y&K l<i<n 

Hence deciding the minimum scaling t of P for which x + tP n / is equivalent to solving a simple 
convex program. The above convex program is exactly in the form described in Theorem IB.4I hence for 
e > 0, and x G Q", we may compute a number u > such that 

\uj — inf \\y — x\\k\ < e (A. 27) 

yeK 

intimepoly(n, (x), (j4)) polylog(-p, i). We now build INT. Onqueryx G Q", e > 0, we do the following: 
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1. Compute a; > satisfying \u} — iniy^x \\y — x\\k\ < f • 

2. If cj < 1 + I return 1, otherwise return 0. 

From (IA.27P the above procedure clearly runs in polytime. To prove correctness, we must show that 
INT(x, e) = 1 if X + P n / and INT(3;, e) = if x + (1 + e)P n = 0. If x + P n / 0, 
we note that infj^gj^ ||y — x||i^ < 1, hence by the guarantee on u we have that 

a; < inf ||y-x||i^ + ^ < 1 + ^, (A.28) 
yeK 2 2 

and so we correctly classify x. If x + (1 + e)P n = 0, then infy^K \\y — x\\k > 1 + e and so 

w > inf \\y - x\\k -^>1 + ^ (A.29) 
y€K 2 2 

as needed. 

We now compute a tiling of K. The idea here is simple. We define a graph G on the lattice L, where 
for X, y G L, X ~ y iff X — y G -^{±61, . . . , ±6„}. We identify each lattice point x G L with the tile 
X + P. Starting from the tile centered at 0, we begin a breadth first search on G of the tiles intersecting K. 
In this way, we will compute the connected component containing in G of tiles intersecting K. Lastly, 
if the number of intersecting K tiles exceeds (4y^^i/)", we abort and return that N{K, E) > H". The 
algorithm is given in Algorithm |7] 

Algorithm 7 Computing a tiling. 

1: M ^ {0},N ^ {o},r ^ 0. 

2: while iV / do 

3: choose X £ N 

4: ^ iV \ {c} 

5: ifINT(x, = Ithen 

6: r^ru{x} 

7: if |r| > (4y%i7)" then 
8: return FAIL 

9: foraUJG -^{±6i,...,±5„}do 
10: if X + 5 ^ M then 

11: N ^ Nu{x},M ^ M\j{x} 

12: return T 



Correctness: To argue correctness of the above algorithm, we must guarantee that the algorithm either 
computes a valid covering of K or that it proves that N{K, E) > H^. For e > 0, let 

= {xGL:x+(l + e)Pni^/0} and = {x G L : INT(x, e) = 1} (A.30) 

From the description above, we see that the algorithm performs a breath first search on G starting from of 
the tiles in H'l . From the properties of the weak intersection oracle INT, we know that Hq C H'l C Hi . 

The goal of the algorithm is to discover a super-set of Hq. Since Hq C H'l, the algorithm will correctly 

n 

add elements of Hq to the cover T if it finds them. Since we perform a breadth first search from 0, to 
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guarantee we find all of Hq we need only ensure that Hq forms a connected subgraph of G. As noted before, 
the set of tiles indexed by Hq are just lattice shifts of the fundamental parallelepiped of L with respect to the 
basis -^{bi, . . . ,bn). In this setting, the connectivity of Hq with respect the edges defined by the basis (i.e. 
the set of tiles touching any convex set), is a classical fact. Therefore, the algorithm will indeed discover all 
of Hq, provided that the partial cover T remains no larger than (^4y^H^^ . 

Now we must justify that if the algorithm aborts, i.e. if \T\ > {4y^H)"', that indeed N{K, E) > H"^. 
Now at every timestep we have that T C H\ C H\ ■ Therefore, to show correctness, it suffices to show that 

\Hi\< (4y^)" N{K, E). Now for x G if^, we have that 



x + {l + -)Pr^K ^ 



n 



xeK + {i + -)P ^x + PeK + {2 + -)P 

n n 



Furthermore, since for x, y S Hi, x ^ y,x + int(P) n y + int(P) 



vol(K + (2 + -)P) > vol(U^gHi x + P) 



n 



Using that P (1 E, and vol(£;) < 
\Hi I < 



(1 + o(l)))"vol(P) we get 



vol(i^ + (2 + ^ I me 



vol(P) 



< 



f (1 + 0(1)) 



< 



'^(i + o(i))(3 + -; 

2 n 




N{K, E)<[A 



: 0, we have that 

I vol(P) 

n 

vol(K + (2 + i)i?) 

voi(£;) 

N{K, E) 




for n large enough. Hence the algorithm correctly decides whether N{K, E) > H"-. 



(A.31) 



(A.32) 



(A.33) 



Runtime: The running time of the algorithm is proportional to the number of tiles visited and the number 
of edges crossed during the search phase. Since all the tiles visited in the algorithm are adjacent to the tiles in 
the set T, and the number of edges is 2n, the total number of tiles visited is at most 2n\T\ < 2n [i^/^H^^ . 
Furthermore, the edges traversed correspond to all the outgoing edges from T, and hence is bounded by 
the same number. Now at every visited tile, we make a call to INT(x, ^) for some x G L, which takes 
poly(n, (A)) polylog(-p) time. Hence the total running time is 



poly(n, (^))polylog( 




as needed. 



H 



(A.34) 



□ 



A.l Geometric Estimates 

Here we list and prove the necessary geometric inequalities that we used in the proofs above. We begin with 
a slight extension of Theorem |B.13l 

Theorem A.l. Let K be a convex body such that b{K) G tEK.for some t G [0, 1). Then 



vol{K n -K) > 



l-t 



vol (is:) 



(A.35) 
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Proof. From Theorem |BTT3] we have that 

^ Yo\{K) < wo\{K - h{K) r\-K + b{K)) = vol{K n-K + 2b{K)) (A.36) 
Next, we note that for x G M" 

Kr\-K + 2x^%^2xeK + K^xeK (A.37) 

Since h{K) G tEx and b{K) + Ek ^ K, we see that (1 — t)EK ^ K. Hence we can write 

= t{-2nb{K)) + (1 - t)2b{K), (A.38) 

where -nb{K) G -(1 - t)EK = (1 - t)EK <Z K. Now we see that 

t {K n {-K + -2nb{K))) + {l-t){Kr\ {-K + 2b{K))) CKn-K (A.39) 

where both sets on the left hand side are non-empty by (IA.37I ). Therefore by the Brunn-Minkowski inequal- 
ity, we have that 

vol{K n -K)^ > t vol {K n {-K + -n2b{K)))^ + (1 - vol {K n {-K + 2b{K)))^ 

1 1-t 1 (A-40) 

> (1 - vol (i^ n {-K + 2b{K)))« > vol(i^) n 

Therefore we get that 

vol{Kn-K) > (^—^] Yol{K) 



as needed. □ 

The next lemma is a slight specialization of IIMPOOi Theorem 5]. We require this inequality for the 
M-ellipsoid certification procedure. 

Theorem A.2 (Duality of Entropy). Let K,T CI be convex bodies where T is centrally symmetric. Then 

N(T, K) < ((1 + o(l))288)" • N{{K - K)* ,T*) (A.41) 

and 

N{{K - K)*,T*) < (12(1 + o(l)))" • 7V(r,E:). (A.42) 

Proof. Since the above quantities are invariant under shifts of K, we may shift K so that b{K) = 0. Apply- 
ing Theorem lB.13[ we see that that vol(i^ — K) < 4" vol{K) < 8" vol{K n —K), where we note that since 
G -fC we have that K n —K (1 K (1 K — K. Next applying the covering estimates from Lemma lB.14[ we 
get that 

N{K -K,K)< N(K -K,Kn -K) < 3" ^°]^^ ~ ^\ < 24". 
From here, we see that 

A^(r, K) < N{T,K - K)N{K - K, K) < 24"iV(r, K - K). (A.43) 
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Next since both T and K — K we. centrally symmetric, we apply Lemma lB.14l to get that 

voi(r) 



iV(T, {K -K))<T 



Yo\{{K -K)r\T)' 



Now we note that {{K-K)^^TY = co\iy{{K - K)* , T*}. Hence applying the Blashke-Santalo inequahty 
to vol(T) and the Bourgain-Milman inequality to vol{{K — K) n T) we get that 

Since is both in (/sT - K)* and T*, we see that conv{(K - K)* ,T*)} <^ {K - K)* + T* and hence 
(6(1 + „(i)yV°l(co°v{(A; -AT.r-}) ^ „,j„,„ vol((K - K). + T') 



vol(r*) - ^ ^ ^ vol(T*) 

Lastly, applying Lemma IB .141 to the last estimate, we get that 

(6(1 + ^(i)))n Vol((K-g-+T-) ^ ^^2(1 + o{lWN{{K - K)\T*). 

Combining the above estimates yields the first desired inequality. 

Now switching the roles {K - K) and T with {K - K)* and T* , we have that 

N{{K - K)\T*) < (12(1 + o(l))"iV(r, K -K)< (12(1 + o(l))"iV(r, K), 

yielding the second inequality. □ 

We now make precise the relationship between the isotropic constant of the exponential reweightings 
defined by Klartag IIKla06l and the M-ellipsoid. 

Lemma A.3. Let K <^W^ be a convex body. Take s G and let fs{x) = e^^'^^ for x £ K and otherwise. 
Let T C be a convex body such that for some 5 > 1 we have that 



^Ef^ C T C 5V^Ef^ (AM) 
where Ej^ is the inertial ellipsoid of fg. Then we have that 

N{K,T)<{126r^'-^^^^^ and N{T, K) < (Ud^y^ vol{V^B^) ^ 1% (A.45) 

where b{K) is the centroid of K, and Lf^ is the isotropic constant of fg. 

Proof. Since the above estimates are all invariant under shifts of K, we may assume that 6(/s) = (centroid 
of fs). We note that h{fs) G K always and hence G ET. Let X be distributed as vrj^, where ttj^ is the 
probability measure induced by fs. So we have that E[X] = h{fs) = and E[XX*] = cov(/s). 
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Remember that Ef_. = {x : cov(/s) ^x < 1}, therefore = y^x* cov{fs)~'^x. Now note that 

E[||X|||^J = E[X*coY{fs)'^X] = E[trace[cov(/,)-^XX*]] = trace[cov(/,)-^ E[XX*]] (A.46) 
= trace [cov(/s)~"'^ cov(/s)] = trace[Id„] = n. (A.47) 

Now by Markov's inequahty, we have that 

7rfS2V^EfJ = 1 - Fr[\\X\\E,^ > 2^^ > 1 = i _ |. = £. (A.48) 

By Jensen's inequaUty, we see that 

[ fs{x)dx= [ e^''''Ux = Yol{K) [ e^'''=^^^>vol{K)e^''^^^^'^=vol{K)fs{b{K)), (A.49) 
Jk Jk Jk vol{K) 

where b{K) is the centroid of K. 

Using (1X491 ) and (lA^Sl) we see that 

s-r^PxeK fs{x) A sup,^(:K fs{x) 4 sup^.g^ /(x) 
Using that C T, G i^, (5 > 1, and by (IA301) we get that 

voi(r n iT) > vol [^Ef^ r\K^ = voi(^% n > vol (^\/^% n ]^k^ 
. (-L)%o,(2^«, n A-) > (1)" I -Mm.^ v„l,«). 

Using the definition of L/^, (IA.48I ). V^-E/, ^ (5T and that G IT, we get that 

det(cov(/.))i = Li _tAW^L < i« ^ < 1 v„l(2^i.,. n K) 

&^VxeKfs{x) 3 sup^g;^/,(x) 3 (^.52) 

< - vol(25T n i^) < {25LkT - vol(rn i^). 
3 3 

Using that T C and the ellipsoid volume formula ( |2.6b . we have that 

vol(r) < vol((5V^%) = (5" vol(V^5^) det(cov(/,))i (A.53) 
Combining equations (IA.52I ). (IA.53I ) we get that 



vol(r) < {25'^LkT vo1(V^5J) - vol(rn i^). (A.54) 

3 



Now applying Lemma |B .141 to the inequalities ( |A.51K ( lA.54b the theorem follows. □ 

From Lemma IA.3[ we see that if the slicing conjecture is true, then for any convex body, its inertial 
ellipsoid appropriately scaled is an M-ellipsoid. To bypass this, Klartag shows that for any convex body 
K, there exists a "mild" exponential reweighting fg of the uniform density on K with bounded isotropic 
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constant. As one can see from Lemma IA31 the severity of the reweighting controls N{K, ^/nEj^) whereas 
the isotropic constant of fg controls N{y/nEf^ , K). 

The main tool to establish the existence of "good" exponential reweightings for K is the following 
lemma, which one can extract from the proof of Theorem 13.61 in ||KIa06l . We will use it here for e = 1, in 
which case the expectation below is of order 2^^^\ The argument is essentially identical to that of IIKla06ll : 
we include it for completeness. 

Lemma A.4 ( IIKla061 ). Let K <Z W be a convex body such that h{K) £ :^Ek- For s G M", let 
fs'K^ denote the function fs{x) = e^'^'^\ x €z K. Let X be distributed as en (convji^, —K})*)for 
some real e > 0. Then we have 




2 



2n 



E[^/^]<|^(i + -(i))V^7ij (^-55) 

Proof. For s define : M+ by fs{x) = e^"'"^^ for x^KAn Lemma 3.2 of IIKla06ll is it shown 
that 

f det(cov(/,))ds = vol(K) (A.56) 

By Theorem lB.llI we have that Ek + b{K) C K. Since h{K) G ■:^^Ek by assumption, we see that 
'^Ek + h{K) C K. Hence Q e K. From IIRS58I . we know that for any convex body K such that 
E if, we have that vol(conv{K, -K}) < 2" yo\{K). 
Let L = conv{K, -K}. Note that 

L* = (conv{if , -K])* = {y ■.\{x,y)\< 1, Vx G K] (A.57) 

Since L is centrally symmetric by the Bourgain-Milman inequality (Theorem lB.121) . we have that 

(l + o(l))— j (A.58) 

Hence we get that 

\ nvol(L)n J \2nvol(K)n / 
Take s e enL* . We examine the properties of fg : K ^ Since s G enL*, we see that 

sup fs{x) = e^"P-eif < e^" (A.60) 

Since h{K) C :^Ek ^ and s G en (conv{K, -K])*, we see that | (s, h{K)) \ < e. Now by Jensen's 
inequality, we have that 

K \Jk ^o\{K)J (A.61) 

= vol(if)e<"'''(-^)> > vol(K)e-^ 

Now we see that 

(A. 62) 
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Applying inequality (IA.62I ). Lemma 3.2 of IIKla06l . and equation (IA.59I ). we get that 

1 f „2(n+l)e f 

L '^K^ ^ vol(.nL.).ol(AT L vol(K)'de.(c„v(/,,).» 



voI(enL*) J^^^ 



Tree / \ v vre A/e 



The above quantity is exactly E[Lf^] since X is uniform over eriL*. The statement thus follows. □ 

B Additional Background 

For two probability distributions cii, o"2 over a domain X, their total variation (or statistical) distance is 

dTv(f^l,fT2) = sup |f7i(A) -a2(A)|. (B.l) 

ACX 

B.l Logconcave functions 

We will need to work with the generalization of convex bodies to logconcave functions. A function / : 
M" — )■ is logconcave if for all x, y G M", and < a < 1, we have that 

/(a^ + (i-«)y) >/(^r/(y)'-" (B.2) 

The canonical examples of logconcave functions are the indicator functions of convex bodies as well as the 
Gaussian distributions. We will now generalize the concepts defined before for convex bodies to logconcave 
functions. 

For a logconcave function / on such that < f{x) dx < oo, we define the associated probability 
measure (distribution) vrj, where for measurable A C R", we have 

[a fix) dx 

^M) = \ ■ (B.3) 

We define the centroid (or barycenter) and covariance matrix of / as 

^^^•^ ^ Iru xf{x)dx cov{f) = /r"^^^ ~ ~ Kf)j)fix) dx ^^-j^^ 

/igi /(^) dx fi^) dx 

The matrix cov(/) is positive semi-definite and symmetric. We say that / is isotropic, or in isotropic 
position, if b{f) = and cov(/) is the identity matrix. Define the inertial ellipsoid of / as 

Ef = E{cow{f)-^) = {x : x*cov(/)-ix < 1} 

The isotropic constant of / is defined as 

^/ = ( T^w\r) " • det(cov(/))^. 
\xm" hn f{x)dxj 
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A natural extension of the slicing conjecture (Conjecture 12.11) is that L/ is bounded by a universal constant. 
This generalized slicing conjecture was shown by Ball IIBal88i to be equivalent to the slicing conjecture for 
convex bodies, up to a constant factor in the precise bound. 

For a convex body K, let -kk denote the uniform measure (distribution) over K. Let fx denote the 
associated density, i.e.. 

We note that the definitions coincide exactly if we replace K by fx, i.e., cov(i^) = cov(//^), b{K) = b{fK), 
Lk = Lfj^, etc. We extend all the notions defined above for log-concave functions to convex bodies in the 
same way, e.g. we let Ek = Ef^. We say that K is in isotropic position if b{K) = and co\{K) is the 
identity (a different normalization is sometimes used in asymptotic convex geometry, namely, b{K) = 0, 
vol(i^) = 1, and cov(i^) is constant diagonal). 



B.2 Computational model 

For a rational matrix A, we define {A) as the length of the binary encoding of A. The lattice algorithms pre- 
sented will have complexity depending on the dimension n of the lattice and the bit length of the description 
of the input basis. 

Since we work with general (semi-)norms, we shall need an appropriate way to represent them. We now 
define the three different types of oracles that we will need. For convenience, our semi-norms will always be 
indexed by a convex body K. With some slight modifications, we will adopt the terminology from IIGLS88II . 

Let iiT C be a convex body. For e > 0, we define 

K' = K + eB^ and K^' = {x £ K : x + eB^ C K} (B.4) 

We say that K is (oq, R)-circumscribed if K Q aQ + RB2 for some oq G Q" and R £ Q. We say that 
K is (oo, r, R)-centered if oq + rB2 Q K (1 + RB2 for oq G Q", r, R G Q. We will always assume 
that the above parameters are given explicitly as part of the input to our problems, and hence our algorithms 
will be allowed to depend polynomially in (oq), (r), (R). 

Definition B.l. A weak membership oracle Ok for K is function which takes as input a point x G Q" and 
real e > 0, and returns 

, , f 1 -.xeK^ 
OK{x,e) = l (B.5) 
10 : X f K " 

where any answer is acceptable if x G K*^ \ K~'^. 

Definition B.2. A strong separation oracle SEP;^ for K on input y G Q" either returns YES ify & K, or 
some c G such that (c, x) < (c, y), Vx G K. 

When working with the above oracle, we assume that there is a polynomial 0, such that on input y 
as above, the output of SEPj^ has size bounded by (p{{y)). The runtimes of algorithms using SEPj^- will 
therefore depend on (p. 

Let Kbe a. convex body containing the origin. 

Definition B.3. A weak distance oracle Dk for is a function that takes as input a point x G Q" and 
e > 0, and returns a rational number satisfying 

\DK{x,e) — ||x||ii-| < e. (B.6) 
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As above, we assume the existence of a polynomial (j), such that the size of the output of Dk on (x, e) 
is bounded by (p{{x), (e)). For a (0, r, i?)-centered body K, \/x G R", we crucially have that 



1 1„ , 

< \\x\\k < - F 
R r 



B.3 Standard Algorithms 



Here we list some of the algorithmic tools we will require. 

The following theorem is essentially the classical equivalence between weak membership and weak 
optimization IIYN76llGLS88l . 

Theorem B.4 (Convex Optimization via Ellipsoid Method). Let K C an {ao, r, R)-centered convex 
body given by a weak membership oracle Ok- Let A G Q™^", c G Q*". Define f : K"' ^ M. as 

f{x)= max {Ai,x) + Ci (B.7) 

l<i<m 

where Ai is the i^^ row of A. Then for e > 0, a number a; G Q satisfying 



\oj - inf f{x)\ < e (B.8) 

x&K 



can be computed using Ok in time 



poly(n, {A), (ao), (c)) polylog(-, -) (B.9) 

r e 

We will also need an algorithm from IIGLS88L which allows one to deterministically compute an ellip- 
soid with relatively good "sandwiching" guarantees for a convex body K. We present a small modification 
of the result in GLS: 

Theorem B.5 (Algorithm GLS-Round). Let K C i?" be an (ao, R)-circumscribed convex body given by a 
strong-separation oracle SEP/^. Then for any e > 0, in poly(log {ao)n) time one can compute A y 0, 
A G Q"^" and t G M", such that the ellipsoid E = E[A) satisfies K <Z E + t, and one of the following : 
(a) vol{E) < e, or (b) ^E + t<^K. 

(n+l)n^ 

The next theorem comes from the literature on random walks on convex bodies IILV06b [ ILV06al lLV06cll . 

Theorem B.6 (Algorithm Logconcave-S ampler, IILV06all ). Let K C be a {qq, r, R)-centered convex 

body given by a weak membership oracle Ok- Let f : K ^ be a polynomial time computable log- 
concave function satisfying 

sup /(x) < /3"/(0) (B.IO) 

for some /3 > 1. Let e, r > 0. Then the following can be computed: 

1. A random point X ^ K with distribution a satisfying dT^Y(a,TTf^) < r in time 

R 1 

poly(n, (ao)) polylog(n, — , /3, -) (B.ll) 

r T 
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2. A point b £ K and a matrix ^ G Q"^" such that V x G 

I (x, 6 — b{fs)) I < e X* cov(/s)x and \x*{A — cov(/s))x| < ex*cov(/^)x, (B.12) 
with probability 1 — 6 in time 

1 R 1 

poly(n, (ao), -) polylog(n, — , -). (B.13) 
e r 

The following simple lemma allows us to construct a strong separation oracle for any hyperplane section 
of a convex body already equipped with a strong separation oracle. 

Lemma B.7. Let K C R" be a convex body presented by a strong separation oracle SEPk- Let H = 
{x £ : Ax = b} denote an affine subspace, where A G Q™^", b G Q*". Then one can construct a 
separation oracle for K D H, such that on input y £ H, the oracle executes in time poly((y), (A), (6)) 
using a single call to SEPk- 

Proof. We wish to construct a strong separation oracle for K n H, where H = {x £ R" : Ax = b} is an 
affine subspace, given a strong separation oracle for K. To do this given y £ H,we do the following. First, 
we call SEPk on y. If SEPk returns that y £ K,we return YES. If SEPk returns a separator c G M" such 
that sup^^K x) < (c, y), we compute c the orthogonal projection of c onto W = {x £ i?" : Ax = 0} 
(the lineality space of H). If c = 0, we note that (c, •) is constant over H. Therefore if K n H ill, there 
exists x £ K n H <^ K such that (c, x) = (c, y), a contradiction. Hence if c = 0, we return that K n H is 
EMPTY. Otherwise, we simply return c. Since the derived oracle simply calls SEPk once and projects any 
found separator onto the lineality space of H, the runtime is clearly poly((yl), (b), (y)) as needed. □ 

We now derive some straightforward applications of the above fundamental tools. 

Corollary B.8 (Algorithm Estimate-Covariance). Let K (IW^ be an (ao, r, R)-centered convex body given 
by a weak membership oracle Ok- Let f : K ^ M-|_ be a polynomial time computable log-concave function 
satisfying 

sup/(x) <e2-/(0). (B.14) 

Then an ellipsoid E[A), A G Q"^", can be computed satisfying 

e~"Ef^ C E{A) C e^Ef^ (B.15) 

with probability 1 — 6 in time poly(n, (ao), log(-p), log(|)). 

Proof Using Theorem IB. 6 [ we can compute a matrix B C Q"^" satisfying 

\x\B - cov(/,))x| < i X* cov(/,)x V X G M", (B.16) 
n 

with probabiliy 1 — 6 in time poly(n) polylog(n, -p, ^). We now condition on the event (IB. 161 ). Remember- 
ing that x^Bx = ||x||^ and x* cov(/s)x = lkllcov(/ )' rewrite ( IB.16I ) as 



re — 1 /re + 1 

-^\\x\Uo.(f^) < \\x\\b < y ^^|k||cov(/,) (B.IV) 
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From the above, we see that the ellipsoid E{cov{fs)) = {x : ||x||(,ov(/s) ^ 1} ^^id ^i^) = • II^^IIb < 1} 
satisfy 

E{cov{fs)) C E{B) C ./ -E{cov{f,)) (B.18) 



n + 1 \j n — 1 

Remembering that the polar ellipsoids satisfy 

E{By=E{B-^) and ^(cov(/,))-i = E(cov(/,)-i) = (B.19) 

where the last equality follows by the definition of Ej^. Taking the polars of the above ellipsoids, the 
containment relationships in (IB.18I) flip, and we get 



" ^Ef^<ZE{B'')<zJ^Ef^ (B.20) 



n \ n 

2 1 2 



Now using the inequalities 1 — ^ > e " for n > 3 and 1 + ^ < e " , we see that (IB. 20b implies 

e~"Ef^ C E{B~^) C (B.21) 

as needed. Letting A = B^^, the ellipsoid E{A) satisfies the desired requirements. □ 

Corollary B.9 (Algorithm Estimate-Centroid). There is a probabilistic algorithm Estimate-Centroid that, 
given a (0, r, R)-centered convex body K presented by a weak membership oracle Ok and some 5 > 0, in 
time poly(n) polylog(n, -p, ^) either outputs FAIL (with probability at most 6) or some b G K such that: 

b + —^——B^ QKQb + 2RB^ (B.22) 
2{n + l)^/n 

and with probability at least 1 — 6, 

b - b{K) G -^Ek. (B.23) 
n + 1 

Proof. Using Theorem IB. 61 we compute a center b ^ K satisfying 

\(x,b- b(K)) I < - — ^—-:r cov(i^)x V X G M", (B.24) 
[n + 1)^ 

with probability 1 — 5 in time poly(n) polylog(n, y, 
First, check whether 

Ok [b± — -Ci, — =1 for 1 < i < n (B.25) 



4(n+l) 4(n+l)^ 

If any of the above tests fail, abort and return FAIL. 

Let 6 = If these tests pass, by the properties of Ok we know that 

5 + — conviibei, . . . , ±e„} C ^b + — ^5? C ^b + — ^Bl' C K (B.26) 

4 4\/n 

Since 6 G K C RB2, we clearly also have that K b + 2RB2. Hence conditioned up outputting b, we 
have that 

b + /' Bl^ <ZKCb + 2RB^ (B.27) 
2{n + l)^/n 
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as needed. 

We now show that if the event (IB.24I ) holds, then the above test will pass and condition (b) will also be 
satisfied. Since this event holds with probability 1 — 6, this will suffice to prove the statement. 
For the center b, we note that for all x G (n + l)£'(cov(/s)), by equation (IB. 241) we have that 

I {b - b{K),x) I < -^^rr^x' cov{K)x < ^4t^(^ + 1)' = 1 (B.28) 

Therefore, we have that b - b{K) G ((n + l)£'(cov(i^)))* = -^Ek as needed. 
We now show that the tests must all pass. From Theorem lB.lll we know that 



b{K) + J "^^-^Ek CKC b{K) + v^n(n + 2)Ek (B.29) 

n 



By the guarantee on Ok, we know that rB'l^ C b{K) + ^Jn(n + 2)Ek- But we have that 



-B^ - b{K) C yjn{n + 2)Ek rB^ + b{K) C yJn{n + 2)EK 



-{rBl^ - b{K)) + -{rBl^ + b{K)) C y^n{n + 2)Ek (B.30) 
rB^ C ^yn{n + 2)EK 



since both Ek and B2 are symmetric. From the inequality n + 1 > n(n + 2), we have that 



r ^ V^^E^ c i^, (B.31) 



n+1 n+1 



Since 6 - b{K) € ;^^a' by assumption, and J^Ek + fc(i^) ^ i^, we get that 



1 n + 2 /n + 2 

6 G b{K) + -Ek ^b + EK^ b{K) + ^-E/r ^ 6 + C + W ^^E;^ C (B.32) 

n+1 n+1 Vn 

Therefore by lB.311 ) we have that b + ^^-^2 C i^T. Letting 5 = from the previous sentence we see that 

b ± ^(5ei G C K'iT^ (B.33) 
Therefore by the properties of Ok, the tests in lB.25l must all pass. The claim thus holds. □ 

B.4 Geometric Inequalities 

Perhaps the most fundamental inequality in the geometry of numbers is Minkowski's first theorem, which is 
stated as follows: 

Theorem B.IO. Let L C M" be an n dimensional lattice and let K C M" denote a centrally symmetric 
convex body. Then 

/det(L)\ " 



Xi{K,L) < 2 



[yoi{K)) 
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The following gives bounds on how well the inertial ellipsoid approximates a convex body. The esti- 
mates below are from IIKLS95i : 



Theorem B.ll. For a convex body K C M", the inertial ellipsoid Ek satisfies 



n + 2 



n 

where equality holds for any simplex. 



Ek'^K - h{K) C ^Jn{n + 2)-Ek (B.34) 



The above containment relationship was shown in ltMP891 for centrally symmetric bodies (with better 
bounds), and by [Son90| for general bodies with suboptimal constants. 

The next theorem gives estimates on the volume product, a fundamental quantity in Asymptotic Con- 
vex Geometry. The upper bound for centrally symmetric bodies follows from the work of Blashke liBlalSI . 
and for general bodies by Santalo fSan49i . The lower bound was first established by Bourgain and Mil- 
man I1BM87II . and was recently refined by Kuperberg [ .KupOS ], as well as by Nazarov ||Naz09ll . where Ku- 
perberg achieves the best constants. Finding the exact minimizer of the volume product is a major open 
problem in Asymptotic Convex Geometry. 

Theorem B.12. Let K be a convex body in M". Then we have 

vol{B^f > inf vol(i^ - x) Yol{{K - x)*) > (^^£il±^iill^ . (b.35) 
x&K \ 2n J 

If K is centrally symmetric, then 

vol(5^)2 > yo\{K) wo\{K*) > + " _ (B.36) 

In both cases, the upper bounds are equalities if and only if K is an ellipsoid. 

We remark that the upper and lower bounds match within a 4" factor (2" for symmetric bodies) since 
vol(5J)2 = Using the M-ellipsoid, one can directly derive weak bounds (i.e., with sub- 

optimal constants) on the volume product. Furthermore, as we shall see in Section |A], the techniques devel- 
oped by Klartag | Kla06 1 can be used to derive the existence of the M-ellipsoid as an essential consequence 
of the volume product bounds. 

The next theorem gives useful volume estimates for some basic operations on a convex body. The first 
estimate is due to Rogers and Shepard IIRS57I . and the second is due Milman and Pajor MMPOOI : 

Theorem B.13. Let K C be a convex body. Then 

vol{K -K)< (^"^ vol{K) < 4^^ vol(i^). 

Ifb{K) = 0, i.e., the centroid of K is at the origin, then 

Yo\{K) < 2'^vol{Kn-K). 

Lastly, we relate some well-known covering estimates. Here N{K, T) = min{|A| : A C MP"^ K Q K + T}, 
where K, T are convex bodies in W^. 
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Lemma B.14. Let K, T C M" be convex bodies. Then 

NiK,T)<6-M and '-^^^^ < rNiK,T). (B.37) 

^ ' cGK" V0l(i^n (T + c)) vol(r) - \ ^ J V ^ 



IfT is centrally symmetric, then 



voi(r/2) • ^^-^^^ 



If both K and T are centrally symmetric, then 

N(K,T) < S^^^J^i^^^T- (B-39) 
Proof. Let us first examine the case wliere T is centrally symmetric, where we wish to show that 

vol(T/2) 

Let A C K be a maximal subset of K such that for xi,X2 G A, xi / X2, xi + T/2 (1x2 + T/2 = 0. 

Claim 1: C u^.gA x + T . 

Take y G By maximality of A, there exists x G A such that 

y + T/2 n x + T/2 / ^ y G x + T/2 - r/2 ^ y G x + T 

where the last equality follows since T is centrally symmetric. The claim thus follows. 

For X G A, note that since x G /C, we have that x + T/2 (Z K + T/2. Therefore A + T/2 C K. Since 
the sets x + T/2, rc G A, are disjoint, we have that 

vol(K + T/2) > vol(A + T/2) = |A| vol(r/2) (B.41) 

as needed. 

Now let us assume that K is also symmetric. Since both K and T are symmetric, we have that K CiT 
is also symmetric. Therefore by the estimate in (IB. 401) we get that 

, vol(K + UTnK)) vol(^K) „ vol(i^) 
N(K,T) < N(K,TnK) < ^ — -< , ' = 3" , ' (B.42) 

^ ' ^- ^ ' voi(i(TnK)) -voi(i(TnK)) voi(rni^) 

as needed. 

Now we examine the case where neither K nor T is necessarily symmetric. Since the covering estimate 
is shift invariant, we may assume that K and T have been shifted such that \o\{K n T) is maximized, 
and that the centroid of K n T is at 0. Let 5 = {K r\T) r\ -{K r\T). By Theorem |B7T3] we have that 
vol(S') > 2^" vol(K n T). Note that 5" is a centrally symmetric convex body. Hence by identical reasoning 
as in (IB.42I) we get that 

N{K,T)<T^-^<Q- 



voi(5) - voi(E:nr) 
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as needed. 

Lastly, pick any A C M** such that C A + T and |A| = Ar(ii:, T). Now we see that 

vol{K + T)< vol((A + T) + T)= vol(A + 2T) < | A| vol(2r) = 2" vo\{T)N{K, T) 
as needed. 
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